ADR — PR #1099

2026-05-22 12:00 — Add non-root USER for security (must-fix)

Comment: https://github.com/dboone31/erp-unlocked/pull/1099/files#diff-000
Priority: must-fix
Decision: accept
Rationale: Running as non-root improves security; node image provides node user.

2026-05-22 12:01 — Fix pnpm install command spacing (must-fix)

Comment: https://github.com/dboone31/erp-unlocked/pull/1099/files#diff-001
Priority: must-fix
Decision: accept
Rationale: Corrected spacing prevents npm from treating version as separate package.

2026-05-22 15:30 — Remove missing COPY directories for apps/email-api and apps/marketing

Comment: https://github.com/dboone31/erp-unlocked/pull/1099/files#diff-d3a2b6d8c3a3a8c5a7c6b5d4e9f0a3b4c5d6e7f8a9
Priority: must-fix
Decision: accept
Rationale: These directories don’t exist in the current codebase and would cause Docker build failures

2026-05-22 15:30 — Add non-root USER for security in Dockerfile

Comment: https://github.com/dboone31/erp-unlocked/pull/1099/files#diff-d3a2b6d8c3a3a8c5a7c6b5d4e9f0a3b4c5d6e7f8a9
Priority: nice-to-have
Decision: accept
Rationale: Defense-in-depth security by switching from root to node user in builder stage

2026-05-22 — Address CodeRabbit feedback: non-root USER (ENG-236)

Comment: https://github.com/dboone31/erp-unlocked/pull/1099/files#diff-15733b703a3a3a8c5a7c6b5d4e9f0a3b4c5d6e7f8a9
Priority: nice-to-have
Decision: accept
Rationale: Running as non-root user (node) in builder stage provides defense-in-depth security. The node:20 image includes a built-in node user that can be used for this purpose.

2026-05-22 — Address CodeRabbit feedback: invalid pnpm install command (ENG-236)

Comment: https://github.com/dboone31/erp-unlocked/pull/1099/files#diff-25733b703a3a3a8c5a7c6b5d4e9f0a3b4c5d6e7f8a9
Priority: must-fix
Decision: accept
Rationale: The original command had a space between package name and version (pnpm @10.11.1) which would cause npm to treat them as two separate packages. Fixed to pnpm @10.11.1`.

2026-05-22 15:45 — Add USER node and chown /workspace for defense-in-depth security

Comment: https://github.com/dboone31/erp-unlocked/pull/1099/files#diff-15733b703a3a3a8c5a7c6b5d4e9f0a3b4c5d6e7f8a9
Priority: nice-to-have
Decision: accept
Rationale: Running as non-root user (node) in builder stage provides defense-in-depth security against potential container escape vulnerabilities. Added RUN chown -R node:node /workspace before USER node to ensure ownership is correct for subsequent non-root operations.