Dockerfile: updates, improvements and fixes

 * update base image to node 20, bookworm and the slim version
 * fix stop signal handling
 * run as the unprivileged 'node' user

Dockerfile

@@ -1,20 +1,24 @@
-FROM node:18-bullseye
+FROM node:20-bookworm-slim
 
 RUN apt-get -y update \
     && apt-get -y install tini \
     && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
-WORKDIR "/srv"
+ENV APP_DIR="/srv/app"
 
-COPY package.json package-lock.json tsconfig.json ./
-COPY src ./src
+WORKDIR ${APP_DIR}
+RUN chown node:node ${APP_DIR}
+
+USER "node"
+
+COPY --chown=node:node package.json package-lock.json tsconfig.json ./
+COPY --chown=node:node src ./src
 
 RUN npm install
 RUN npm run build
 
 ENV NODE_ENV="production"
 
 EXPOSE 3000/tcp
-VOLUME ["/root/.npm", "/root/.rgb-proxy-server"]
 
-CMD ["tini", "--", "npm", "run", "start"]
+CMD ["tini", "--", "node", "./dist/server.js"]