Nicolas Pastorello
ef5c7c3f51
Fixes all issues raised in PR #47 review: 1. Add .dockerignore to prevent: - Real .env secrets baked into image layers - Host node_modules (glibc) overwriting alpine (musl) → ABI mismatch - .git, reports/, evidence/ bloating the image 2. Fix compose host-binding: - Remove T3MP3ST_HOST=127.0.0.1 override (was breaking port forwarding) - Server now binds to 0.0.0.0 in-container (DOCKER=true from Dockerfile) - Host mapping stays 127.0.0.1:3333:3333 for security 3. Add critical security warning in DOCKER.md: - Explain exposure risk of 0.0.0.0 binding + disabled Host-header guard - Document safe vs unsafe deployment patterns - Warn against network_mode: host and -p 3333:3333 without 127.0.0.1 4. Update base image: - node:18-alpine → node:22-alpine (Node 18 EOL) - Pin by digest @sha256:16e22a550... (prevent floating tag drift) 5. Fix healthcheck in compose: - Was always returning success (process.exit(0)) - Now actually tests /api/health endpoint - Add start_period: 40s to align with Dockerfile 6. Fix port typos in DOCKER.md: - 3000 → 3333 in troubleshooting examples - Update all example snippets to node:22-alpine with digest
23 lines
520 B
YAML
23 lines
520 B
YAML
services:
|
|
app:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
container_name: t3mp3st
|
|
restart: unless-stopped
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
- T3MP3ST_PORT=3333
|
|
volumes:
|
|
- ./reports:/app/reports
|
|
- ./evidence:/app/evidence
|
|
ports:
|
|
- "127.0.0.1:3333:3333"
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3333/api/health"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 40s
|