From 712374d1bf68cde573cd195b2dd6f69d67e39a8f Mon Sep 17 00:00:00 2001 From: Grok Bot Date: Mon, 31 Aug 2026 20:39:40 +0000 Subject: [PATCH] Slim prod image: patch Alpine openssl, drop unused npm Scan Container on the 16.3.3 image flagged Alpine libcrypto3/libssl3 CVE-2026-14456 and HIGH/CRITICAL in the Node image bundled npm CLI. Next/React/sharp were clean. Prod only runs node server.js, so apk-upgrade openssl 3.5.8 and delete npm/corepack/yarn from the prod stage. --- Dockerfile | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 9655099..4316052 100644 --- a/Dockerfile +++ b/Dockerfile @@ -17,7 +17,17 @@ FROM docker.io/library/node:$nodever-alpine AS prod WORKDIR /app ENV NODE_ENV=production ENV NEXT_TELEMETRY_DISABLED=1 -RUN addgroup -S nextjs && adduser -S nextjs -G nextjs +RUN addgroup -S nextjs && adduser -S nextjs -G nextjs \ + && apk add --no-cache --upgrade "libcrypto3>=3.5.8-r0" "libssl3>=3.5.8-r0" \ + && rm -rf \ + /usr/local/lib/node_modules/npm \ + /usr/local/lib/node_modules/corepack \ + /opt/yarn-v* \ + /usr/local/bin/npm \ + /usr/local/bin/npx \ + /usr/local/bin/corepack \ + /usr/local/bin/yarn \ + /usr/local/bin/yarnpkg # Copy standalone server and assets COPY --from=builder /app/.next/standalone ./ COPY --from=builder /app/.next/static ./.next/static