Harden render server and import boundaries

server/Dockerfile

@@ -10,11 +10,16 @@ RUN apt-get update && apt-get install -y \
 
 ENV PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium
 ENV PORT=6000
+ENV HOST=127.0.0.1
 
 WORKDIR /app
-COPY package.json ./
-RUN npm install --omit=dev
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev
 COPY . .
 
+RUN groupadd -r ruwio && useradd -r -g ruwio -d /app -s /usr/sbin/nologin ruwio \
+  && chown -R ruwio:ruwio /app
+USER ruwio
+
 EXPOSE 6000
 CMD ["node", "server.js"]