Nicolas Pastorello
ef5c7c3f51
Fixes all issues raised in PR #47 review: 1. Add .dockerignore to prevent: - Real .env secrets baked into image layers - Host node_modules (glibc) overwriting alpine (musl) → ABI mismatch - .git, reports/, evidence/ bloating the image 2. Fix compose host-binding: - Remove T3MP3ST_HOST=127.0.0.1 override (was breaking port forwarding) - Server now binds to 0.0.0.0 in-container (DOCKER=true from Dockerfile) - Host mapping stays 127.0.0.1:3333:3333 for security 3. Add critical security warning in DOCKER.md: - Explain exposure risk of 0.0.0.0 binding + disabled Host-header guard - Document safe vs unsafe deployment patterns - Warn against network_mode: host and -p 3333:3333 without 127.0.0.1 4. Update base image: - node:18-alpine → node:22-alpine (Node 18 EOL) - Pin by digest @sha256:16e22a550... (prevent floating tag drift) 5. Fix healthcheck in compose: - Was always returning success (process.exit(0)) - Now actually tests /api/health endpoint - Add start_period: 40s to align with Dockerfile 6. Fix port typos in DOCKER.md: - 3000 → 3333 in troubleshooting examples - Update all example snippets to node:22-alpine with digest
44 lines
894 B
Docker
44 lines
894 B
Docker
# syntax=docker/dockerfile:1
|
|
|
|
FROM node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2
|
|
|
|
# Install dependencies
|
|
RUN apk add --no-cache \
|
|
bash \
|
|
curl \
|
|
git \
|
|
openssl \
|
|
ca-certificates
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy package files
|
|
COPY package*.json ./
|
|
COPY tsconfig.json ./
|
|
|
|
# Install dependencies
|
|
RUN npm ci && \
|
|
npm cache clean --force
|
|
|
|
# Copy source code
|
|
COPY . .
|
|
|
|
# Build TypeScript
|
|
RUN npm run build
|
|
|
|
# Ensure docs directory exists for /ui static files
|
|
RUN mkdir -p docs
|
|
|
|
# Docker environment marker (tells server.ts to bind to 0.0.0.0)
|
|
ENV DOCKER=true
|
|
|
|
# Expose port
|
|
EXPOSE 3333
|
|
|
|
# Health check
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
|
|
CMD wget --no-verbose --tries=1 --spider http://localhost:3333/api/health || exit 1
|
|
|
|
# Default command: run the server (not interactive CLI)
|
|
CMD ["npm", "run", "server"]
|