archetecture security fix

docker/entrypoint.production.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env sh
+set -eu
+
+# Start as root only long enough to prepare writable runtime mounts, then drop
+# to the unprivileged app user before running Node/NPM. If chown is blocked by
+# a hardened runtime, continue and let the app fail loudly on write attempts.
+if [ "$(id -u)" = "0" ]; then
+  mkdir -p /var/lib/rentaldrivego/storage/public /var/lib/rentaldrivego/storage/private /tmp/rentaldrivego
+  chown -R app:app /var/lib/rentaldrivego /tmp/rentaldrivego 2>/dev/null || true
+  exec su app -s /bin/sh -c 'exec "$@"' -- "$@"
+fi
+
+exec "$@"