From 0bffa5a3ee9cf290ba32dab3a8147a3a6f5dc910 Mon Sep 17 00:00:00 2001 From: Manuel Raynaud Date: Mon, 5 Oct 2026 20:42:33 +0200 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=A7(dockerfile)=20switch=20yhub=20imag?= =?UTF-8?q?e=20to=20slim=20image?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The yhub image was using a normal debian images with to many dependencies installed that can contain CVE. Using a slim image is enough --- .github/workflows/docker-hub.yml | 3 +-- src/yhub-server/Dockerfile | 19 ++++++++++++++++--- 2 files changed, 17 insertions(+), 5 deletions(-) diff --git a/.github/workflows/docker-hub.yml b/.github/workflows/docker-hub.yml index 5c7039f56..a7de9412b 100644 --- a/.github/workflows/docker-hub.yml +++ b/.github/workflows/docker-hub.yml @@ -79,8 +79,7 @@ jobs: file: src/yhub-server/Dockerfile target: yhub should_push: ${{ github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'preview') }} - # no docker_user: the image defaults to uid 1000, the `node` user the - # base image already declares in /etc/passwd + docker_user: 1000 notify-argocd: needs: diff --git a/src/yhub-server/Dockerfile b/src/yhub-server/Dockerfile index 7ceda9e4c..422c94a17 100644 --- a/src/yhub-server/Dockerfile +++ b/src/yhub-server/Dockerfile @@ -1,5 +1,12 @@ -# trixie for glibc >= 2.38 — uws prebuilt binaries reject bookworm's 2.36 -FROM node:22-trixie AS base +# trixie for glibc >= 2.38 — uws prebuilt binaries reject bookworm's 2.36. +# slim: the full image ships compilers, imagemagick, mariadb... that the server +# never uses and that the vulnerability scan of the CI reports. +FROM node:22-trixie-slim AS base + +# Upgrade system packages to install security updates +RUN apt-get update && \ + apt-get upgrade -y && \ + rm -rf /var/lib/apt/lists/* WORKDIR /app @@ -48,7 +55,13 @@ RUN yarn build # ---- Production image ---- FROM base AS yhub -RUN yarn install --frozen-lockfile --production +# the cache is cleaned in the same layer: it keeps a copy of every package of +# the lockfile, the development ones included +RUN yarn install --frozen-lockfile --production && \ + yarn cache clean + +# npm is not needed at runtime and bundles its own, rarely updated, dependencies +RUN rm -rf /usr/local/bin/npm /usr/local/bin/npx /usr/local/lib/node_modules/npm COPY --from=yhub-builder /app/dist ./dist