Initial curated CertScope source from fe2bbe3ca5c98bf64be26a09c6c58ee805a7f87e

Dockerfile

@@ -0,0 +1,61 @@
+ARG NODE_BASE_IMAGE=node:22.23.2-alpine3.24@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32
+
+FROM ${NODE_BASE_IMAGE} AS deps
+WORKDIR /app
+
+COPY package.json package-lock.json ./
+RUN npm ci --ignore-scripts
+
+FROM ${NODE_BASE_IMAGE} AS build
+WORKDIR /app
+
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+
+COPY --from=deps /app/node_modules ./node_modules
+COPY package.json package-lock.json next.config.mjs tsconfig.json next-env.d.ts ./
+COPY app ./app
+COPY lib ./lib
+COPY public ./public
+
+RUN npm run build
+
+FROM ${NODE_BASE_IMAGE} AS runner
+WORKDIR /app
+
+ARG BUILD_VERSION=1.0.4
+ARG BUILD_REVISION=local
+
+ENV NODE_ENV=production
+ENV HOSTNAME=0.0.0.0
+ENV PORT=3000
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV CERTSCOPE_BUILD_REVISION=$BUILD_REVISION
+
+LABEL org.opencontainers.image.revision=$BUILD_REVISION \
+  org.opencontainers.image.version=$BUILD_VERSION \
+  org.opencontainers.image.title="CertScope" \
+  org.opencontainers.image.description="Explainable DNS, TLS and HTTP posture inspection with hardened SSRF boundaries."
+
+RUN addgroup --system --gid 1001 nodejs \
+  && adduser --system --uid 1001 nextjs
+
+# The runtime does not need package managers. Upgrade the pinned Alpine layer
+# to the current security revision, then remove npm/npx/corepack from the
+# attack surface scanned and shipped with production.
+RUN apk upgrade --no-cache \
+  && rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack \
+  && rm -f /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack
+
+COPY --from=build --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=build --chown=nextjs:nodejs /app/.next/static ./.next/static
+COPY --from=build --chown=nextjs:nodejs /app/public ./public
+
+USER nextjs
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+  CMD wget -q -O /dev/null --timeout=4 http://127.0.0.1:3000/api/health || exit 1
+
+CMD ["node", "server.js"]