Engineering / ENG-1499
Run the container as the unprivileged node user
Description
notifier's image runs as root. Nothing needs it: the service listens on 8080 and writes only to /tmp.
USER nodein the Dockerfile; files owned by node.- Read-only root file system in the task definition, /tmp as a volume.
- The image scan in CI fails on a root user from now on.
identity-service and portal next, once this one has run a week.
Merged. Deployed with notifier 2026.06.24 to every region; smoke tests pass.