Sandboxing

server/sandbox/Dockerfile

@@ -0,0 +1,23 @@
+FROM node:22-alpine
+
+RUN apk add --no-cache libreoffice curl \
+    && addgroup -g 1000 sandbox \
+    && adduser -u 1000 -G sandbox -s /bin/sh -D sandbox \
+    && mkdir -p /app /tmp/convert \
+    && chown -R sandbox:sandbox /app /tmp/convert
+
+WORKDIR /app
+
+COPY --chown=sandbox:sandbox package.json ./
+RUN npm install --omit=dev
+
+COPY --chown=sandbox:sandbox convert.js ./
+
+USER sandbox
+
+EXPOSE 3002
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
+    CMD curl -f http://localhost:3002/health || exit 1
+
+CMD ["node", "convert.js"]