feat: make the studio image rootless

[InsidersByte]

@coderabbitai summary

Checklist

• [ ] I have discussed my proposed changes in an issue and have received approval to proceed.
• [ ] I have followed the coding standards of the project.
• [ ] Tests or benchmarks have been added or updated.
• [ ] Documentation has been updated on https://github.com/wundergraph/cosmo-docs.
• [x] I have read the Contributors Guide.

I tested this locally by altering the docker-compose.full.yml to build the studio by copying the build instructions for the studio from the docker-compose.cosmo.yml.

Closes #2206

[coderabbitai[bot]]

Walkthrough

The Dockerfile for the studio image was updated to run as a non-root user, add bash, set a working directory, and adjust COPY operations with ownership to node:node. Entrypoint permissions are ensured, and environment variables remain unchanged. The final stage uses USER node with owner-aware artifacts.

Changes

Cohort / File(s)	Summary of Changes
Rootless Docker runtime for Studio studio/Dockerfile	Added bash; set WORKDIR /app; switched to USER node; replaced COPY with --chown=node:node for app artifacts; preserved NODE_ENV and NEXT_TELEMETRY_DISABLED; ensured entrypoint.sh is executable under non-root; final image contents owned by node:node.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

[!TIP]

👮 Agentic pre-merge checks are now available in preview!

Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.

• Built-in checks – Quickly apply ready-made checks to enforce title conventions, require pull request descriptions that follow templates, validate linked issues for compliance, and more.
• Custom agentic checks – Define your own rules using CodeRabbit’s advanced agentic capabilities to enforce organization-specific policies and workflows. For example, you can instruct CodeRabbit’s agent to verify that API documentation is updated whenever API schema files are modified in a PR. Note: Upto 5 custom checks are currently allowed during the preview period. Pricing for this feature will be announced in a few weeks.

Please see the documentation for more information.

Example:

reviews:
  pre_merge_checks:
    custom_checks:
      - name: "Undocumented Breaking Changes"
        mode: "warning"
        instructions: |
          Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).

Please share your feedback with us on this Discord post.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Pre-merge checks

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title Check	✅ Passed	The title "feat: make the studio image rootless" is concise, follows Conventional Commits style, and accurately summarizes the primary change—making the Studio Docker image run as a non-root user—which matches the Dockerfile changes in the PR.
Linked Issues Check	✅ Passed	The Dockerfile changes (owner-aware COPY with --chown=node:node, switching to USER node, setting WORKDIR, and ensuring the entrypoint is executable) directly address the permission errors described in issue #2206 and enable the image to run as a non-root user by making relevant files writable by that user.
Out of Scope Changes Check	✅ Passed	Changes are limited to studio/Dockerfile and focus on ownership and runtime-user adjustments to support rootless execution; adding bash is ancillary but related to runtime behavior and no unrelated source files were modified.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

[YassineElbouchaibi]

@StarpTech Any chance you could have a look at this one ? Sorry for tagging you directly, just want to avoid the PR getting stale and closed. The ability to run cosmo stack while being rootless is of great importance in heavily locked down production environments.

[Leletir]

Hello, any chance this will get merged ? It's blocking us to use Cosmo in our clusters as we can't run containers as root

[github-actions[bot]]

This PR was marked stale due to lack of activity. It will be closed in 14 days.

[InsidersByte]

@miklosbarabas are there any updates on this? (Just trying to keep the pr active as otherwise it'll be closed)

[github-actions[bot]]

This PR was marked stale due to lack of activity. It will be closed in 14 days.

[InsidersByte]

Bump

[github-actions[bot]]

This PR was marked stale due to lack of activity. It will be closed in 14 days.

[github-actions[bot]]

Closed as inactive. Feel free to reopen if this PR is still being worked on.