Dockerfile non-root user #36

gpmayorga · 2024-02-29T16:41:07Z

Change the Dockefile to run as non-root by default.

filo87

I would also update the node FROM image to a more generic 18-alpine so we get a better upgrading.

For the username lets stick to node, so we can use it also for outflux.

Platform specification to amd64 might break Development on AppleSilicon

filo87 · 2024-03-01T09:40:12Z

Dockerfile

 RUN yarn install --production=true --frozen-lockfile

 FROM node:18.14-alpine as prod-build

 WORKDIR /usr/src/app

+# Create a non-root user and switch to it
+# Note: You might need to adjust permissions more restrictively depending on your app's specific needs
+RUN adduser -D indexer && chown -R indexer:indexer /usr/src/app


Suggested change

RUN adduser -D indexer && chown -R indexer:indexer /usr/src/app

RUN adduser -D node && chown -R node:node /usr/src/app

filo87 · 2024-03-01T09:40:24Z

Dockerfile

+# Create a non-root user and switch to it
+# Note: You might need to adjust permissions more restrictively depending on your app's specific needs
+RUN adduser -D indexer && chown -R indexer:indexer /usr/src/app
+USER indexer


Suggested change

USER indexer

USER node

filo87 · 2024-03-01T09:42:16Z

Dockerfile

+RUN adduser -D indexer && chown -R indexer:indexer /usr/src/app
+USER indexer
+
+# Copy necessary files
 COPY package*.json ./


Suggested change

COPY package*.json ./

COPY --chown=node:node package*.json ./

redundant, as we have already selected USER before hand and therefore everything below it will inherit this user's permissions

filo87 · 2024-03-01T09:42:37Z

Dockerfile

+RUN adduser -D indexer && chown -R indexer:indexer /usr/src/app
+USER indexer
+
+# Copy necessary files
 COPY package*.json ./
 COPY yarn*.lock ./


Suggested change

COPY yarn*.lock ./

COPY --chown=node:node yarn*.lock ./

redundant, as we have already selected USER before hand and therefore everything below it will inherit this user's permissions

filo87 · 2024-03-01T09:42:54Z

Dockerfile

+RUN adduser -D indexer && chown -R indexer:indexer /usr/src/app
+USER indexer
+
+# Copy necessary files
 COPY package*.json ./
 COPY yarn*.lock ./
 COPY --from=build /usr/src/app/dist ./dist


Suggested change

COPY --from=build /usr/src/app/dist ./dist

COPY --from=build --chown=node:node /usr/src/app/dist ./dist

redundant, as we have already selected USER before hand and therefore everything below it will inherit this user's permissions

filo87 · 2024-03-01T09:43:19Z

Dockerfile

+RUN adduser -D indexer && chown -R indexer:indexer /usr/src/app
+USER indexer
+
+# Copy necessary files
 COPY package*.json ./
 COPY yarn*.lock ./
 COPY --from=build /usr/src/app/dist ./dist
 COPY --from=prod-install /usr/src/app/node_modules ./node_modules


Suggested change

COPY --from=prod-install /usr/src/app/node_modules ./node_modules

COPY --from=prod-install --chown=node:node /usr/src/app/node_modules ./node_modules

redundant, as we have already selected USER before hand and therefore everything below it will inherit this user's permissions

filo87 · 2024-03-01T09:45:39Z

Dockerfile

@@ -1,37 +1,55 @@
-FROM node:18.14-alpine as install
+# --platform=linux/amd64  is necessary when building on M1/M3 Macintosh locally
+FROM --platform=linux/amd64  node:18.14-alpine as install


Suggested change

FROM --platform=linux/amd64 node:18.14-alpine as install

FROM --platform=linux/amd64 node:18-alpine as install

Lets pack in also some better upgrading of node

Also I do not know if specifying the platform is a good idea...because this could break development on AppleSilicon

quite the opposite, AppleSilicon can run Linux based arch containers as the engine is fully virtualized (a Linux VM running on your mac) even though sometimes this might not work.
This way, if you build a container and push from your laptop, it will not be Mac specific which is a better outcome than pushing a docker container with the wrong arch instead

filo87 · 2024-03-01T09:47:07Z

Dockerfile

 RUN yarn build

-FROM node:18.14-alpine as prod-install
+FROM --platform=linux/amd64 node:18.14-alpine as prod-install


Suggested change

FROM --platform=linux/amd64 node:18.14-alpine as prod-install

FROM --platform=linux/amd64 node:18-alpine as prod-install

filo87 · 2024-03-01T09:48:51Z

Dockerfile

 COPY package*.json ./
 COPY yarn*.lock ./
+
+# Install only production dependencies
 RUN yarn install --production=true --frozen-lockfile

 FROM node:18.14-alpine as prod-build


Suggested change

FROM node:18.14-alpine as prod-build

FROM node:18-alpine as prod-build

filo87 · 2024-03-01T09:49:37Z

Dockerfile

 COPY package*.json ./
 COPY yarn*.lock ./
+
+# Install dependencies
 RUN yarn install --production=false

 FROM node:18.14-alpine as build


Suggested change

FROM node:18.14-alpine as build

FROM node:18-alpine as build

gpmayorga and others added 12 commits September 5, 2023 00:58

More efficient and clean Dockerfile

6f5b899

Simple docker push setup

f947dba

fix Dockerfile

3a3aa5f

Full docker CI workflow

babc893

Better Docker tags

252f28e

Merge branch 'embrio-tech:main' into main

18bccf5

Merge remote-tracking branch 'upstream/main'

a24482e

run Docker as non-root by default

a7b6833

fix build layer name

a85f1e3

remove old ci file

30e1c99

update Dockerfile from fork

db30b3c

add Docker Mac compatibility

29b4b09

gpmayorga requested a review from filo87 March 1, 2024 09:26

gpmayorga mentioned this pull request Mar 1, 2024

add non-root user embrio-tech/centrifuge-outflux#30

Closed

filo87 approved these changes Mar 1, 2024

View reviewed changes

use outflux dockerfile instead

f64a055

centrifuge closed this by deleting the head repository May 8, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Dockerfile non-root user #36

Dockerfile non-root user #36

gpmayorga commented Feb 29, 2024 •

edited

Loading

filo87 left a comment

filo87 Mar 1, 2024

filo87 Mar 1, 2024

filo87 Mar 1, 2024

gpmayorga Mar 5, 2024

filo87 Mar 1, 2024

gpmayorga Mar 5, 2024

filo87 Mar 1, 2024

gpmayorga Mar 5, 2024

filo87 Mar 1, 2024

gpmayorga Mar 5, 2024

filo87 Mar 1, 2024

filo87 Mar 1, 2024

filo87 Mar 1, 2024

gpmayorga Mar 5, 2024

filo87 Mar 1, 2024

filo87 Mar 1, 2024

filo87 Mar 1, 2024

	RUN adduser -D indexer && chown -R indexer:indexer /usr/src/app
	RUN adduser -D node && chown -R node:node /usr/src/app

	COPY package*.json ./
	COPY --chown=node:node package*.json ./

	COPY --from=build /usr/src/app/dist ./dist
	COPY --from=build --chown=node:node /usr/src/app/dist ./dist

	COPY --from=prod-install /usr/src/app/node_modules ./node_modules
	COPY --from=prod-install --chown=node:node /usr/src/app/node_modules ./node_modules

	FROM --platform=linux/amd64 node:18.14-alpine as install
	FROM --platform=linux/amd64 node:18-alpine as install

	FROM node:18.14-alpine as prod-build
	FROM node:18-alpine as prod-build

Dockerfile non-root user #36

Dockerfile non-root user #36

Conversation

gpmayorga commented Feb 29, 2024 • edited Loading

filo87 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gpmayorga commented Feb 29, 2024 •

edited

Loading