Skip to content

Change Dockerfile to Chainguard Wolfi-Base to Reduce Vulnerabilities #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
zackchadwick wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Change Dockerfile to Chainguard Wolfi-Base to Reduce Vulnerabilities #5

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4662e1f
Change to chainguard wofli base image to reduce vulnerabilities
zackchadwick Apr 5, 2024
a012c57
Merge branch 'main' into chainguard-dockerfile
ndom91 Apr 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 31 additions & 14 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,21 @@
###########################
# BASE CONTAINER #
###########################
FROM node:lts-bookworm-slim AS base
FROM cgr.dev/chainguard/wolfi-base AS base

RUN mkdir /pnpm

ENV PNPM_HOME="/pnpm"
ENV PATH="$PNPM_HOME:$PATH"

# Enable pnpm
RUN corepack enable
RUN apk update && apk add --no-cache \
pnpm \
nodejs-20 \
openssl

# Dump default nonroot user and create node:node
RUN deluser nonroot && rm -rf /home/nonroot \
&& addgroup -g 65532 node && adduser -D node -G node -u 65532

###########################
# BUILDER CONTAINER #
Expand All @@ -18,9 +27,13 @@ WORKDIR /app
RUN mkdir -p /prod/web \
&& mkdir -p /prod/backend

# Install openssl for prisma
RUN apt-get update -qq \
&& apt-get install -y openssl git
RUN apk add --no-cache \
git \
python-3.12 \
make \
npm \
playwright \
chromium

RUN --mount=type=cache,id=pnpm,target=/pnpm/store pnpm install --frozen-lockfile

Expand All @@ -38,17 +51,17 @@ RUN pnpm run -r build \
FROM base AS web

ENV NODE_ENV production

# Install openssl for prisma
RUN apt-get update -qq \
&& apt-get install -y openssl

# Remove cache and apk binary
RUN rm -rf /var/cache/apk/* && rm /sbin/apk

COPY --chown=node:node --from=build /prod/web /prod/web

# Generate prisma client and push db schema
RUN cd /prod/web \
&& pnpm dlx prisma generate

USER node
WORKDIR /prod/web
EXPOSE ${PORT:-3000}
CMD [ "pnpm", "start" ]
Expand All @@ -60,17 +73,21 @@ FROM base AS backend

ENV NODE_ENV production

# Install openssl for prisma
RUN apt-get update -qq \
&& apt-get install -y openssl
RUN apk add --no-cache \
playwright \
chromium

# Remove cache and apk binary
RUN rm -rf /var/cache/apk/* && rm /sbin/apk

COPY --chown=node:node --from=build /prod/backend /prod/backend

# Generate prisma client and install playwright chromium + deps
RUN cd /prod/backend \
&& pnpm dlx prisma generate \
&& pnpm exec playwright install --with-deps chromium
&& pnpm exec playwright install chromium

USER node
WORKDIR /prod/backend
EXPOSE ${PORT:-8000}
CMD [ "pnpm", "start" ]