Grok Bot
712374d1bf
Scan Container on the 16.3.3 image flagged Alpine libcrypto3/libssl3 CVE-2026-14456 and HIGH/CRITICAL in the Node image bundled npm CLI. Next/React/sharp were clean. Prod only runs node server.js, so apk-upgrade openssl 3.5.8 and delete npm/corepack/yarn from the prod stage.
39 lines
1.0 KiB
Docker
39 lines
1.0 KiB
Docker
#
|
|
# LMGCITFY Dockerfile
|
|
#
|
|
ARG nodever=22
|
|
|
|
# STAGE 1: Build the application
|
|
FROM docker.io/library/node:$nodever-alpine AS builder
|
|
WORKDIR /app
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
COPY package*.json ./
|
|
RUN npm ci
|
|
COPY ./ ./
|
|
RUN npm run build
|
|
|
|
# STAGE 2: Prod build
|
|
FROM docker.io/library/node:$nodever-alpine AS prod
|
|
WORKDIR /app
|
|
ENV NODE_ENV=production
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
RUN addgroup -S nextjs && adduser -S nextjs -G nextjs \
|
|
&& apk add --no-cache --upgrade "libcrypto3>=3.5.8-r0" "libssl3>=3.5.8-r0" \
|
|
&& rm -rf \
|
|
/usr/local/lib/node_modules/npm \
|
|
/usr/local/lib/node_modules/corepack \
|
|
/opt/yarn-v* \
|
|
/usr/local/bin/npm \
|
|
/usr/local/bin/npx \
|
|
/usr/local/bin/corepack \
|
|
/usr/local/bin/yarn \
|
|
/usr/local/bin/yarnpkg
|
|
# Copy standalone server and assets
|
|
COPY --from=builder /app/.next/standalone ./
|
|
COPY --from=builder /app/.next/static ./.next/static
|
|
COPY --from=builder /app/public ./public
|
|
# Jump in
|
|
USER nextjs
|
|
EXPOSE 3000
|
|
ENTRYPOINT [ "node", "server.js" ]
|