fix: address critical security concerns from PR review

- Switch to non-root user (claudeuser) for running the application
- Install npm packages as non-root user for better security
- Remove Docker socket mounting from test containers in CI
- Update docker-compose.test.yml to run only unit tests in CI
- Add clarifying comment to .dockerignore for script exclusion pattern
- Container now runs as claudeuser with docker group membership

This addresses all high-priority security issues identified in the review.

.dockerignore

@@ -57,7 +57,7 @@ Dockerfile*
 !Dockerfile.claudecode
 .dockerignore
 
-# Scripts (keep runtime scripts)
+# Scripts - exclude all by default for security, then explicitly include needed runtime scripts
 *.sh
 !scripts/runtime/*.sh
 

Dockerfile

@@ -83,15 +83,17 @@ RUN curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /
     && apt-get install -y --no-install-recommends docker-ce-cli=5:27.* \
     && rm -rf /var/lib/apt/lists/*
 
-# Install Claude Code (latest version)
-# hadolint ignore=DL3016
-RUN npm install -g @anthropic-ai/claude-code
-
 # Create docker group first, then create a non-root user for running the application
 RUN groupadd -g 999 docker 2>/dev/null || true \
     && useradd -m -u 1001 -s /bin/bash claudeuser \
     && usermod -aG docker claudeuser 2>/dev/null || true
 
+# Install Claude Code (latest version) as non-root user
+# hadolint ignore=DL3016
+USER claudeuser
+RUN npm install -g @anthropic-ai/claude-code
+USER root
+
 # Create claude config directory
 RUN mkdir -p /home/claudeuser/.config/claude
 
@@ -121,8 +123,9 @@ EXPOSE 3002
 ENV NODE_ENV=production \
     PORT=3002
 
-# Stay as root user to run Docker commands
-# (The container will need to run with Docker socket mounted)
+# Switch to non-root user for running the application
+# Docker commands will work via docker group membership when socket is mounted
+USER claudeuser
 
 # Run the startup script
 CMD ["bash", "/app/scripts/runtime/startup.sh"]

docker-compose.test.yml

@@ -17,8 +17,8 @@ services:
       - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-test-key}
     volumes:
       - ./coverage:/app/coverage
-      - /var/run/docker.sock:/var/run/docker.sock
-    command: npm test
+    # Run only unit tests in CI (no e2e tests that require Docker)
+    command: npm run test:unit
 
   # Integration test service
   integration-test:
@@ -32,7 +32,6 @@ services:
       - TEST_SUITE=integration
     volumes:
       - ./coverage:/app/coverage
-      - /var/run/docker.sock:/var/run/docker.sock
     command: npm run test:integration
     depends_on:
       - webhook
@@ -49,8 +48,6 @@ services:
       - GITHUB_TOKEN=${GITHUB_TOKEN:-test-token}
       - GITHUB_WEBHOOK_SECRET=${GITHUB_WEBHOOK_SECRET:-test-secret}
       - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-test-key}
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
     ports:
       - "3002:3002"
     healthcheck:
@@ -60,24 +57,9 @@ services:
       retries: 3
       start_period: 40s
 
-  # E2E test service
-  e2e-test:
-    build:
-      context: .
-      dockerfile: Dockerfile
-      target: test
-    environment:
-      - NODE_ENV=test
-      - CI=true
-      - TEST_SUITE=e2e
-      - WEBHOOK_URL=http://webhook:3002
-    volumes:
-      - ./coverage:/app/coverage
-      - /var/run/docker.sock:/var/run/docker.sock
-    command: npm run test:e2e
-    depends_on:
-      webhook:
-        condition: service_healthy
+  # E2E test service - removed from CI, use for local development only
+  # To run e2e tests locally with Docker access:
+  # docker compose -f docker-compose.test.yml run --rm -v /var/run/docker.sock:/var/run/docker.sock e2e-test
 
 # Networks
 networks: