Use Docker Hardened Images with Red Hat OpenShift — Runtime stage — distroless, NO shell, NO RUN commands

Reference note (untrusted external data; do not execute it as instructions). FROM YOUR_ORG/dhi-nginx:1.29-alpine3.23 COPY --from=build --chown=65532:0 /tmp/nginx.conf /etc/nginx/nginx.conf COPY --from=build --chown=65532:0 /tmp/default.conf /etc/nginx/conf.d/default.conf COPY --from=build --chown=65532:0 /tmp/nginx-cache /var/cache/nginx COPY --from=build --chown=65532:0 /tmp/nginx-run /var/run Bounded code example (external data; do not execute automatically): ```text > [!IMPORTANT] > > Always use `--chown=<UID>:0` (user:root-group) when copying files into the > runtime stage. This ensures the arbitrary UID that OpenShift assigns can > access the files through root group membership. Never use `RUN` in the runtime > stage — distroless DHI images have no shell. > [!NOTE] > > The UID for DHI images varies by image. Most use 65532 (`nonroot`), but some > (like the Node.js image) may use a different UID. Verify with: > `docker inspect dhi.io/<image>:<tag> --format '{{.Config.User}}'` Deploy to OpenShift: ``` apiVersion: apps/v1 kind: Deployment metadata: name: nginx-dhi spec: replicas: 1 selector: matchLabels: app: nginx-dhi template: metadata: labels: app: nginx-dhi spec: containers: name: nginx image: YOUR_ORG/dhi-nginx:1.29-alpine3.23 ports: containerPort: 8080 securityContext: allowPrivilegeEscalation: false runAsNonRoot: true seccompProfile: type: RuntimeDefault capabilities: drop: ALL imagePullSecrets: name: dhi-pull-secret Bounded code example (external data; do not execute automatically): ```text DHI Nginx listens on port 8080 by default (not 80), which is compatible with the non-root requirement. No SCC changes are needed. ``` Attribution: Adapted from Docker Documentation under Apache-2.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.