feat: marketplace modules and isolated container management

docker/supervisor/supervisord.conf

@@ -4,7 +4,7 @@
 ;   - platform-backend : NestJS Management-API (127.0.0.1:3000)
 ;   - nginx            : Reverse Proxy (0.0.0.0:8080)
 ; Ab Phase 3 werden hier die Modul-Prozesse registriert.
-; Läuft als unprivilegierter Benutzer "app".
+; Supervisor has only SETUID/SETGID/KILL; backend and Nginx workers run as app.
 ; =============================================================
 
 [supervisord]
@@ -13,9 +13,10 @@ logfile=/dev/null
 logfile_maxbytes=0
 pidfile=/tmp/supervisord.pid
 childlogdir=/tmp
+user=root
 
 [program:platform-backend]
-command=node dist/main.js
+command=/usr/bin/setpriv --reuid=app --regid=app --groups=%(ENV_DOCKER_SOCKET_GID)s --inh-caps=+setuid,+setgid,+kill --ambient-caps=+setuid,+setgid,+kill -- node dist/main.js
 directory=/app/platform-backend
 autorestart=true
 startretries=10
@@ -36,4 +37,4 @@ stopsignal=QUIT
 stopwaitsecs=10
 redirect_stderr=true
 stdout_logfile=/dev/stdout
-stdout_logfile_maxbytes=0
+stdout_logfile_maxbytes=0