Release v1.1.5

Update the GitHub repository URL in release.js to point to the correct organization.
Improve formatting in SECURITY.md by adding newlines before code blocks and fixing YAML indentation for better readability.
Implement non root user for running BentoPDF

Dockerfile

@@ -1,11 +1,8 @@
 # Build stage
 FROM node:20-alpine AS builder
-
 WORKDIR /app
-
 COPY package*.json ./
 RUN npm ci
-
 COPY . .
 
 # Build without type checking (vite build only)
@@ -15,11 +12,39 @@ ENV SIMPLE_MODE=$SIMPLE_MODE
 RUN npm run build -- --mode production
 
 # Production stage
-FROM nginx:alpine
+FROM nginxinc/nginx-unprivileged:stable-alpine-slim
 
-COPY --from=builder /app/dist /usr/share/nginx/html
-COPY nginx.conf /etc/nginx/nginx.conf
+COPY --chown=nginx:nginx --from=builder /app/dist /usr/share/nginx/html
+COPY --chown=nginx:nginx nginx.conf /etc/nginx/nginx.conf
+RUN mkdir -p /etc/nginx/tmp && chown -R nginx:nginx /etc/nginx/tmp
 
-EXPOSE 80
+EXPOSE 8080
+CMD ["nginx", "-g", "daemon off;"]
 
-CMD ["nginx", "-g", "daemon off;"]
+
+# Old Dockerfile for Root User
+# # Build stage
+# FROM node:20-alpine AS builder
+
+# WORKDIR /app
+
+# COPY package*.json ./
+# RUN npm ci
+
+# COPY . .
+
+# # Build without type checking (vite build only)
+# # Pass SIMPLE_MODE environment variable if provided
+# ARG SIMPLE_MODE=false
+# ENV SIMPLE_MODE=$SIMPLE_MODE
+# RUN npm run build -- --mode production
+
+# # Production stage
+# FROM nginx:alpine
+
+# COPY --from=builder /app/dist /usr/share/nginx/html
+# COPY nginx.conf /etc/nginx/nginx.conf
+
+# EXPOSE 8080
+
+# CMD ["nginx", "-g", "daemon off;"]

README.md

@@ -104,8 +104,11 @@ You can run BentoPDF locally for development or personal use.
 
 You can run BentoPDF directly from Docker Hub without cloning the repository:
 
+You can also watch the video on how to set it up 👉
+[BentoPDF Docker Setup](https://drive.google.com/file/d/1C4eJ2nqeaH__1Tlad-xuBHaF2Ha4fSBf/view?usp=drive_link)
+
 ```bash
-docker run -p 3000:80 bentopdf/bentopdf:latest
+docker run -p 3000:8080 bentopdf/bentopdf:latest
 ```
 
 Open your browser at: http://localhost:3000
@@ -124,7 +127,7 @@ services:
     image: bentopdf/bentopdf:latest
     container_name: bentopdf
     ports:
-      - '3000:80'
+      - '3000:8080'
     restart: unless-stopped
 ```
 
@@ -149,6 +152,23 @@ For organizations that want a clean, distraction-free interface focused solely o
 
 For more details, see [SIMPLE_MODE.md](SIMPLE_MODE.md).
 
+### 🔒 Security Features
+
+BentoPDF runs as a non-root user using nginx-unprivileged for enhanced security:
+
+- **Non-Root Execution**: Container runs with minimal privileges using nginx-unprivileged
+- **Port 8080**: Uses high port number to avoid requiring root privileges
+- **Security Best Practices**: Follows Principle of Least Privilege
+
+#### Basic Usage
+
+```bash
+docker build -t bentopdf .
+docker run -p 8080:8080 bentopdf
+```
+
+For detailed security configuration, see [SECURITY.md](SECURITY.md).
+
 ### 📦 Version Management
 
 BentoPDF supports semantic versioning with multiple Docker tags:

SECURITY.md

@@ -0,0 +1,110 @@
+# Security Configuration
+
+## Non-Root User Support
+
+BentoPDF now uses nginx-unprivileged for enhanced security. This follows the Principle of Least Privilege and is essential for production environments.
+
+### Security Benefits
+
+- **Reduced Attack Surface**: If compromised, attackers won't have root privileges
+- **Compliance**: Meets security standards like SOC 2, PCI DSS
+- **Kubernetes/OpenShift Compatibility**: Works with security policies that require non-root execution
+- **System Protection**: Prevents system-wide damage if the application is compromised
+
+### Usage
+
+#### Default Configuration (nginx-unprivileged)
+
+```bash
+docker build -t bentopdf .
+docker run -p 8080:8080 bentopdf
+```
+
+#### Simple Mode
+
+```bash
+# Build with simple mode enabled
+docker build --build-arg SIMPLE_MODE=true -t bentopdf-simple .
+
+# Run the container
+docker run -p 8080:8080 bentopdf-simple
+```
+
+#### Kubernetes Example
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bentopdf
+spec:
+  template:
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 2000
+        runAsGroup: 2000
+      containers:
+        - name: bentopdf
+          image: bentopdf:latest
+          ports:
+            - containerPort: 8080
+```
+
+#### Docker Compose Example
+
+```yaml
+version: '3.8'
+services:
+  bentopdf:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      args:
+        SIMPLE_MODE: false
+    ports:
+      - '8080:8080'
+    security_opt:
+      - no-new-privileges:true
+```
+
+### Verification
+
+To verify the container is running as non-root:
+
+```bash
+# Check the user inside the container
+docker exec <container_id> whoami
+# Should output: nginx
+
+# Check the user ID
+docker exec <container_id> id
+# Should show UID/GID for nginx user (typically 101)
+```
+
+### Security Best Practices
+
+1. **Use nginx-unprivileged**: Built-in non-root user with minimal privileges
+2. **Regular Updates**: Keep the base image updated (currently using 1.29-alpine)
+3. **Port 8080**: Use high port numbers to avoid requiring root privileges
+4. **Security Scanning**: Regularly scan images for vulnerabilities
+5. **Network Policies**: Implement network segmentation
+
+### Troubleshooting
+
+If you encounter permission issues:
+
+1. **Check file ownership**: Ensure all application files are owned by the nginx user
+2. **Verify PID directory**: Ensure `/etc/nginx/tmp/` directory exists and is writable
+3. **Port binding**: Ensure port 8080 is available and not blocked by firewall
+
+### Migration from Root
+
+If migrating from a root-based setup:
+
+1. Update your Dockerfile to use nginx-unprivileged base image
+2. Change port mappings from 80 to 8080 in all configurations
+3. Update nginx.conf to use `/etc/nginx/tmp/nginx.pid` for PID file
+4. Rebuild your images with the new security settings
+5. Update your deployment configurations (Kubernetes, Docker Compose, etc.)
+6. Test thoroughly in a staging environment

docker-compose.dev.yml

@@ -3,7 +3,9 @@ services:
     build:
       context: .
       dockerfile: Dockerfile
+      args:
+        SIMPLE_MODE: false # false for default mode, true for simple mode
     container_name: bentopdf
     ports:
-      - '3000:80'
+      - '8080:8080'
     restart: unless-stopped

docker-compose.yml

@@ -6,4 +6,4 @@ services:
     container_name: bentopdf
     restart: unless-stopped
     ports:
-      - '3000:80'
+      - '8080:8080'

nginx.conf

@@ -1,3 +1,5 @@
+pid /etc/nginx/tmp/nginx.pid;
+
 events {
     worker_connections 1024;
 }
@@ -15,7 +17,7 @@ http {
     gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json;
 
     server {
-        listen 80;
+        listen 8080;
         server_name localhost;
         root /usr/share/nginx/html;
         index index.html;

package.json

@@ -1,7 +1,7 @@
 {
   "name": "bento-pdf",
   "private": true,
-  "version": "1.1.4",
+  "version": "1.1.5",
   "license": "Apache-2.0",
   "type": "module",
   "scripts": {

scripts/release.js

@@ -91,7 +91,7 @@ function main() {
   console.log(`🎉 Release v${newVersion} complete!`);
   console.log(`📦 Docker image: bentopdf/bentopdf:${newVersion}`);
   console.log(
-    `🏷️  GitHub release: https://github.com/AltuisticIsopod/bentopdf/releases/tag/${tagName}`
+    `🏷️  GitHub release: https://github.com/alam00000/bentopdf/releases/tag/${tagName}`
   );
 }