dfdc6d489c
All checks were successful
CI / checks (pull_request) Successful in 38s
Add a dedicated 'app' user/group in the production image stage so the application runs without root privileges. The build stage retains root for apk add of build-time dependencies. Changes: - Create 'app' user and group via addgroup/adduser - Change ownership of /data to app:app - Set USER app before EXPOSE and CMD Closes mailship-c3s
67 lines
No EOL
1.5 KiB
Docker
67 lines
No EOL
1.5 KiB
Docker
# syntax=docker/dockerfile:1
|
|
FROM node:22-alpine AS build
|
|
|
|
WORKDIR /app
|
|
|
|
# Install build dependencies for native modules
|
|
RUN apk add --no-cache python3 make g++ git
|
|
|
|
# Install pnpm
|
|
RUN corepack enable && corepack prepare pnpm@latest --activate
|
|
|
|
# Copy package files
|
|
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
|
|
COPY remove-pnpm-overrides.js ./
|
|
|
|
# Remove pnpm link overrides for production build
|
|
RUN node remove-pnpm-overrides.js package.json
|
|
|
|
# Install dependencies
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
# Copy source
|
|
COPY tsconfig.json ./
|
|
COPY src/ ./src/
|
|
COPY src/pages/ ./src/pages/
|
|
COPY src/emails/ ./src/emails/
|
|
|
|
# Build TypeScript (runs tsc && build:html)
|
|
RUN pnpm run build
|
|
|
|
# Production image
|
|
FROM node:22-alpine AS production
|
|
|
|
WORKDIR /app
|
|
|
|
RUN apk add --no-cache sqlite
|
|
|
|
# Install pnpm
|
|
RUN corepack enable && corepack prepare pnpm@latest --activate
|
|
|
|
# Copy production dependencies
|
|
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
|
|
COPY remove-pnpm-overrides.js ./
|
|
RUN node remove-pnpm-overrides.js package.json
|
|
RUN pnpm install --frozen-lockfile --prod
|
|
|
|
# Copy build artifacts
|
|
COPY --from=build /app/dist/ ./dist/
|
|
COPY --from=build /app/src/pages/ ./dist/pages/
|
|
COPY --from=build /app/src/emails/ ./dist/emails/
|
|
|
|
# Create data directory for SQLite
|
|
RUN mkdir -p /data
|
|
|
|
# Create non-root user for security hardening
|
|
RUN addgroup -S app && adduser -S -G app app
|
|
RUN chown -R app:app /data
|
|
|
|
USER app
|
|
|
|
EXPOSE 4738
|
|
|
|
ENV NODE_ENV=production
|
|
ENV PORT=4738
|
|
ENV DATA_DIR=/data
|
|
|
|
CMD ["node", "dist/index.js"] |