What's Changed
- chore: switch runtime image to distroless, pin base digests and strip binary by @mxssl in #303
- Internal ws request id from string to int by @KirillPamPam in #306
⚠️ Breaking: container now runs as uid 65532 (distroless nonroot)
The runtime image was rebased onto distroless/static:nonroot. The process no
longer runs as the nodecore user (1001:1001) but as 65532:65532, and the
binary moved to /app/nodecore (working directory /app).
If you mount TLS or gRPC auth private keys from the host, files that were
group-owned by 1001 are no longer readable and the app fails at startup:
PNC unable to create the app error="unable to create grpc server: open
/path/to/tls.key: permission denied"
Action required. Re-own the mounted secrets to the new gid before upgrading:
chown root:65532 <key files> && chmod 0640 <key files>
Restart the container after fixing permissions — they are not re-read at runtime.
Running the container as root is not a supported workaround.
Full Changelog: 1.12.2...1.12.3