Merge main into staging to sync

canvas/Dockerfile

@@ -21,6 +21,10 @@ EXPOSE 3000
 ENV PORT=3000
 ENV HOSTNAME="0.0.0.0"
 # Non-root runtime — node image defaults to root, explicitly drop.
-RUN addgroup -g 1000 canvas && adduser -u 1000 -G canvas -s /bin/sh -D canvas
+# node:20-alpine ships with a `node` user at uid/gid 1000; remove it before
+# claiming 1000 for `canvas` so `addgroup -g 1000` doesn't collide.
+RUN deluser --remove-home node 2>/dev/null || true; \
+    delgroup node 2>/dev/null || true; \
+    addgroup -g 1000 canvas && adduser -u 1000 -G canvas -s /bin/sh -D canvas
 USER canvas
 CMD ["node", "server.js"]