Don't run as root. Set env to production.

.gitignore

@@ -0,0 +1,2 @@
+resources
+.hugo_build.lock

Containerfile

@@ -1,5 +1,17 @@
 FROM alpine
-RUN apk add git hugo
+
+ENV HUGO_ENVIRONMENT=production
+
 WORKDIR /app
-COPY . /app
+RUN apk add git hugo
+
+RUN adduser \
+    --disabled-password \
+    --gecos "" \
+    --uid 1000 \
+    hugo
+RUN chown hugo:hugo /app
+USER hugo
+
 CMD hugo server --bind 0.0.0.0
+COPY . /app

container-build.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-version="0.1.1"
+version="0.2.0"
 script_dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 tmp_dir="$(mktemp -d --suffix=-web)"
 cleanup () { rm -Rfv "$tmp_dir"; }