matty/lmgcitfy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Slim prod image: patch Alpine openssl, drop unused npm

Browse Source 
Scan Container on the 16.3.3 image flagged Alpine libcrypto3/libssl3 CVE-2026-14456 and HIGH/CRITICAL in the Node image bundled npm CLI. Next/React/sharp were clean. Prod only runs node server.js, so apk-upgrade openssl 3.5.8 and delete npm/corepack/yarn from the prod stage.
This commit is contained in:
Grok Bot
2026-08-31 20:39:40 +00:00
parent 4f61902ca2
commit 712374d1bf
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+11 -1
View File
@@ -17,7 +17,17 @@ FROM docker.io/library/node:$nodever-alpine AS prod
WORKDIR /app
ENV NODE_ENV=production
ENV NEXT_TELEMETRY_DISABLED=1
RUN addgroup -S nextjs && adduser -S nextjs -G nextjs
RUN addgroup -S nextjs && adduser -S nextjs -G nextjs \
&& apk add --no-cache --upgrade "libcrypto3>=3.5.8-r0" "libssl3>=3.5.8-r0" \
&& rm -rf \
/usr/local/lib/node_modules/npm \
/usr/local/lib/node_modules/corepack \
/opt/yarn-v* \
/usr/local/bin/npm \
/usr/local/bin/npx \
/usr/local/bin/corepack \
/usr/local/bin/yarn \
/usr/local/bin/yarnpkg
# Copy standalone server and assets
COPY --from=builder /app/.next/standalone ./
COPY --from=builder /app/.next/static ./.next/static