fix: More chown and version pinning (#3314)

Dockerfile

@@ -16,13 +16,12 @@ ENV CI true
 COPY . /app
 
 RUN yq -i '.version = "'${default_tag}'"' public/version.yaml && \
-  make resolve validate && \
-  chown -R 101:0 /app/nginx
+  make resolve validate
 
 RUN npm run build:docker
 
 # ---- Serve ----
-FROM nginxinc/nginx-unprivileged:1.27-alpine
+FROM nginxinc/nginx-unprivileged:1.27.1-alpine3.20
 WORKDIR /app
 
 # apps
@@ -32,7 +31,9 @@ COPY --from=builder /app/build /app/core-ui
 COPY --from=builder /app/nginx/nginx.conf /etc/nginx/
 COPY --from=builder /app/nginx/mime.types /etc/nginx/
 
-RUN ls -lha /etc/nginx
+USER root:root
+RUN chown -R nginx:root /etc/nginx /app/core-ui
+USER nginx:nginx
 
 EXPOSE 8080
 ENTRYPOINT ["nginx", "-g", "daemon off;"]