MCP-449 Clean up dependencies from the Docker image

[nquinquenel]

No description provided.

[hashicorp-vault-sonar-prod]

MCP-449

[sonar-review-alpha]

Summary

This PR removes unused build dependencies from the production Docker image and test containers to reduce attack surface and image size. Specifically:

• Removed git from the Dockerfile and test container setup (previously noted as required by proxied servers, but no longer needed)
• Removed npm (bundled with nodejs, making it redundant; the image only needs the nodejs runtime)
• Kept nodejs as a required runtime dependency

All references in documentation and test setup are updated consistently to reflect this cleanup.

What reviewers should know

Where to focus:

• Start with the Dockerfile changes—these are the core of the PR
• Check test files to confirm the package removals don't break test infrastructure
• Verify the README documentation now accurately describes remaining dependencies

Key considerations for reviewers:

• Confirm that git and npm are genuinely unused (search code for any invocations if uncertain)
• The branch name suggests this relates to a CVE—verify that removing these packages addresses the security concern without breaking functionality
• Image size/layer changes are a side benefit but not the primary goal here

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonar-review-alpha]

LGTM! ✅

🗣️ Give feedback