-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
…ective app folder.
- Loading branch information
There are no files selected for viewing
This file was deleted.
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,25 +1,17 @@ | ||
# Build | ||
FROM node:22.5.1-slim AS build | ||
FROM python:3.7-slim | ||
Check failure Code scanning / Trivy Image user should not be 'root' High
Artifact: backend/Dockerfile
Type: dockerfile Vulnerability DS002 Severity: HIGH Message: Specify at least 1 USER command in Dockerfile with non-root user as argument Link: DS002 Check notice Code scanning / Trivy No HEALTHCHECK defined Low
Artifact: backend/Dockerfile
Type: dockerfile Vulnerability DS026 Severity: LOW Message: Add HEALTHCHECK instruction in your Dockerfile Link: DS026 |
||
|
||
# Copy, build static files; see .dockerignore for exclusions | ||
WORKDIR /app | ||
COPY . ./ | ||
ENV PRISMA_CLI_BINARY_TARGETS debian-openssl-3.0.x | ||
RUN npm run deploy | ||
RUN apt-get -y update | ||
Check failure Code scanning / Trivy 'RUN <package-manager> update' instruction alone High
Artifact: backend/Dockerfile
Type: dockerfile Vulnerability DS017 Severity: HIGH Message: The instruction 'RUN update' should always be followed by ' install' in the same RUN statement. Link: DS017 |
||
|
||
RUN apt-get -y install git build-essential libgdal-dev | ||
Check failure Code scanning / Trivy 'apt-get' missing '--no-install-recommends' High
Artifact: backend/Dockerfile
Type: dockerfile Vulnerability DS029 Severity: HIGH Message: '--no-install-recommends' flag is missed: 'apt-get -y install git build-essential libgdal-dev' Link: DS029 |
||
|
||
# Deploy using minimal Distroless image | ||
FROM gcr.io/distroless/nodejs22-debian12:nonroot | ||
ENV NODE_ENV production | ||
ENV PATH="/usr/bin/python3:${PATH}" | ||
|
||
# Copy app and dependencies | ||
WORKDIR /app | ||
COPY --from=build /app/node_modules ./node_modules | ||
COPY --from=build /app/dist ./dist | ||
|
||
# Boilerplate, not used in OpenShift/Kubernetes | ||
EXPOSE 3000 | ||
HEALTHCHECK --interval=30s --timeout=3s CMD curl -f http://localhost:3000/api | ||
RUN python3 -m pip install 'setuptools<58.0' | ||
RUN python3 -m pip install --upgrade pip | ||
|
||
COPY . /app | ||
|
||
# Nonroot user, limit heap size to 50 MB | ||
USER nonroot | ||
CMD ["--max-old-space-size=50", "/app/dist/main"] | ||
# RUN chmod +x load_fixtures.sh works when i pull the dockerfile into backend but not when dockerfile is with other docker files | ||
RUN chmod +x /app |
This file was deleted.