62 lines
1.9 KiB
Docker
62 lines
1.9 KiB
Docker
ARG NODE_BASE_IMAGE=node:22.23.2-alpine3.24@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32
|
|
|
|
FROM ${NODE_BASE_IMAGE} AS deps
|
|
WORKDIR /app
|
|
|
|
COPY package.json package-lock.json ./
|
|
RUN npm ci --ignore-scripts
|
|
|
|
FROM ${NODE_BASE_IMAGE} AS build
|
|
WORKDIR /app
|
|
|
|
ENV NODE_ENV=production
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY package.json package-lock.json next.config.mjs tsconfig.json next-env.d.ts ./
|
|
COPY app ./app
|
|
COPY lib ./lib
|
|
COPY public ./public
|
|
|
|
RUN npm run build
|
|
|
|
FROM ${NODE_BASE_IMAGE} AS runner
|
|
WORKDIR /app
|
|
|
|
ARG BUILD_VERSION=1.0.4
|
|
ARG BUILD_REVISION=local
|
|
|
|
ENV NODE_ENV=production
|
|
ENV HOSTNAME=0.0.0.0
|
|
ENV PORT=3000
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
ENV CERTSCOPE_BUILD_REVISION=$BUILD_REVISION
|
|
|
|
LABEL org.opencontainers.image.revision=$BUILD_REVISION \
|
|
org.opencontainers.image.version=$BUILD_VERSION \
|
|
org.opencontainers.image.title="CertScope" \
|
|
org.opencontainers.image.description="Explainable DNS, TLS and HTTP posture inspection with hardened SSRF boundaries."
|
|
|
|
RUN addgroup --system --gid 1001 nodejs \
|
|
&& adduser --system --uid 1001 nextjs
|
|
|
|
# The runtime does not need package managers. Upgrade the pinned Alpine layer
|
|
# to the current security revision, then remove npm/npx/corepack from the
|
|
# attack surface scanned and shipped with production.
|
|
RUN apk upgrade --no-cache \
|
|
&& rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack \
|
|
&& rm -f /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack
|
|
|
|
COPY --from=build --chown=nextjs:nodejs /app/.next/standalone ./
|
|
COPY --from=build --chown=nextjs:nodejs /app/.next/static ./.next/static
|
|
COPY --from=build --chown=nextjs:nodejs /app/public ./public
|
|
|
|
USER nextjs
|
|
|
|
EXPOSE 3000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
|
|
CMD wget -q -O /dev/null --timeout=4 http://127.0.0.1:3000/api/health || exit 1
|
|
|
|
CMD ["node", "server.js"]
|