# Clusev terminal sidecar — Node ws↔SSH bridge (pure JS: ws + ssh2, no native addons).
FROM node:20-bookworm-slim

WORKDIR /app
COPY package.json ./
RUN npm install --omit=dev && npm cache clean --force

COPY server.js ./

# Run as the bundled unprivileged node user.
USER node

EXPOSE 3000
CMD ["node", "server.js"]