Dockerfile

FROM postgres:16.11-alpine3.23

# Remove unnecessary packages and clean up to minimize attack surface
RUN rm -rf /var/cache/apk/*

# Create necessary directories with proper permissions
RUN mkdir -p /var/lib/postgresql/data /run/postgresql \
    && chown -R postgres:postgres /var/lib/postgresql /run/postgresql \
    && chmod 700 /var/lib/postgresql/data \
    && chmod 755 /run/postgresql

# Copy database files
COPY --chown=postgres:postgres database/ /docker-entrypoint-initdb.d/

# Set environment variables
ENV PGDATA=/var/lib/postgresql/data

# Security hardening
# Drop all capabilities and add only what's needed
# Run as non-root postgres user
# Disable privilege escalation
USER postgres

# Health check
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
    CMD pg_isready -U postgres || exit 1

# Expose PostgreSQL port
EXPOSE 5432

# Use default postgres entrypoint (handles signals properly)
CMD ["postgres"]