FROM node:24-bookworm-slim
WORKDIR /workspace
COPY --chown=node:node package.json package-lock.json ./
RUN chown node:node /workspace
USER node
RUN npm ci --no-audit --no-fund
CMD ["npm", "run", "build"]