feat(docker): enhance Dockerfile with entrypoint script and additional packages

- Added `su-exec` to the Docker image for improved user switching.
- Introduced a custom entrypoint script to manage container startup.
- Ensured the creation of necessary directories with appropriate permissions.
- Updated health check configurations for better reliability.

deploy/docker/cfdm/Dockerfile

@@ -34,7 +34,7 @@ RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked \
 
 FROM ${BASE_NODE} AS runtime
 WORKDIR /app
-RUN apk add --no-cache ca-certificates wget
+RUN apk add --no-cache ca-certificates wget su-exec
 ARG VERSION=dev
 ARG GIT_SHA=unknown
 ARG BUILD_TIME=
@@ -47,8 +47,11 @@ ENV NODE_ENV=production \
     GIT_SHA=${GIT_SHA} \
     BUILD_TIME=${BUILD_TIME}
 COPY --from=build --chown=node:node /out ./
-RUN mkdir -p /data && chown node:node /data /app
-USER node
+COPY deploy/docker/cfdm/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+RUN chmod 755 /usr/local/bin/docker-entrypoint.sh \
+    && mkdir -p /data \
+    && chown node:node /data /app
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 EXPOSE 8080
 VOLUME ["/data"]
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \

deploy/docker/cfdm/docker-entrypoint.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+set -eu
+
+mkdir -p /data
+
+if [ "$(id -u)" = "0" ]; then
+  chown -R node:node /data 2>/dev/null || true
+  chmod -R u+rwX /data 2>/dev/null || true
+  if su-exec node sh -c 'touch /data/.write-test && rm -f /data/.write-test'; then
+    exec su-exec node "$@"
+  fi
+  echo "cfdm: /data is not writable by user node after chown; starting as root" >&2
+fi
+
+exec "$@"