Update Dockerfile

Dockerfile

@@ -1,26 +1,24 @@
-# ---------- Stage 1: 下载并解压（抛弃）----------
+# ---------- Stage 1: 下载 ----------
 FROM debian:stable-slim AS fetcher
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-        ca-certificates curl tar && \
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl tar && \
     rm -rf /var/lib/apt/lists/*
-
 WORKDIR /tmp
 ARG OPENLIST_VERSION=beta
 RUN curl -L -o openlist.tar.gz \
-        https://github.com/OpenListTeam/OpenList/releases/download/${OPENLIST_VERSION}/openlist-linux-amd64.tar.gz && \
+    https://github.com/OpenListTeam/OpenList/releases/download/${OPENLIST_VERSION}/openlist-linux-amd64.tar.gz && \
     tar -xzf openlist.tar.gz && \
     chmod +x openlist
 
-# ---------- Stage 2: 最终运行环境 ----------
+# ---------- Stage 2: 运行 ----------
 FROM gcr.io/distroless/base-debian12
 
-LABEL maintainer="[email protected]"
+ENV TZ=Asia/Shanghai
 WORKDIR /opt/openlist
-COPY --from=fetcher /tmp/openlist /opt/openlist/openlist
 
-# 时区：只需要告诉 glibc 使用哪个 tz，不必携带 tzdata 全表
-ENV TZ=Asia/Shanghai
+# 把可执行文件 + 一个空 data/ 目录一起复制，并把这整个目录归 nonroot 所有
+COPY --chown=nonroot:nonroot --from=fetcher /tmp/openlist ./openlist
+COPY --chown=nonroot:nonroot --from=fetcher /dev/null ./data/.   # 创建空 data/
 
 EXPOSE 8080
+USER nonroot
 ENTRYPOINT ["./openlist","server"]