I opened an issue about adding a non-root

USER

to the production Dockerfile: https://github.com/lightdash/lightdash/issues/20322 Currently the

prod

stage doesn't set a

USER

directive, so the container runs as root by default. This is a security concern — if a vulnerability is exploited, an attacker could gain root-level access to the container. Docker's best practices also recommend running as a non-root user: https://docs.docker.com/build/building/best-practices/#user I'd like to contribute a PR for this. Before I start, a few questions: - Is this something the team would welcome as a contribution? (I see it's tracked as PROD-3033) - Should this be treated as a breaking change? Users who mount host volumes may hit permission issues after this change. - Any preference on UID/GID values or approach? Happy to align on the approach first before writing any code. Thanks!

Hi, thanks for the detail - our engineering team are quite busy right now, but we'll get back to you here with some info!

Hey, thanks so much for flagging this and offering to contribute — we really appreciate it! 🙏 This is something we've had on our radar for a while, and especially after yesterday's axios package incident, we're actively reviewing key security areas including this one. We'd like to handle this one internally though — while the code changes themselves are fairly contained, there are some breaking change risks for self-hosted users (volume permissions, bind mounts, custom Dockerfiles extending our image) that we want to be really deliberate about and fully understand the implications. We want to work closely with our self-hosted community to make sure the rollout is smooth and doesn't cause unexpected downtime for anyone. We'll keep the GitHub issue updated as we make progress. Thanks again for raising it! lightdash

Thanks for the thoughtful response! The axios incident definitely highlighted how important these foundational security measures are — glad to hear it's on your radar. Totally understand wanting to handle this carefully given the impact on self-hosted users. Looking forward to seeing the progress on the issue. Happy to help review or test if needed! 🙌