Nicolas Pastorello
ef5c7c3f51
Fixes all issues raised in PR #47 review: 1. Add .dockerignore to prevent: - Real .env secrets baked into image layers - Host node_modules (glibc) overwriting alpine (musl) → ABI mismatch - .git, reports/, evidence/ bloating the image 2. Fix compose host-binding: - Remove T3MP3ST_HOST=127.0.0.1 override (was breaking port forwarding) - Server now binds to 0.0.0.0 in-container (DOCKER=true from Dockerfile) - Host mapping stays 127.0.0.1:3333:3333 for security 3. Add critical security warning in DOCKER.md: - Explain exposure risk of 0.0.0.0 binding + disabled Host-header guard - Document safe vs unsafe deployment patterns - Warn against network_mode: host and -p 3333:3333 without 127.0.0.1 4. Update base image: - node:18-alpine → node:22-alpine (Node 18 EOL) - Pin by digest @sha256:16e22a550... (prevent floating tag drift) 5. Fix healthcheck in compose: - Was always returning success (process.exit(0)) - Now actually tests /api/health endpoint - Add start_period: 40s to align with Dockerfile 6. Fix port typos in DOCKER.md: - 3000 → 3333 in troubleshooting examples - Update all example snippets to node:22-alpine with digest
43 lines
502 B
Plaintext
43 lines
502 B
Plaintext
# Environment files (may contain real secrets)
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
|
|
# Git
|
|
.git
|
|
.gitignore
|
|
|
|
# Node modules (host might be glibc, container is musl)
|
|
node_modules
|
|
|
|
# Reports and evidence (mounted as volumes)
|
|
reports
|
|
evidence
|
|
|
|
# Build artifacts
|
|
dist
|
|
*.log
|
|
npm-debug.log*
|
|
|
|
# IDE
|
|
.vscode
|
|
.idea
|
|
*.swp
|
|
*.swo
|
|
|
|
# OS
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# Docker
|
|
docker-compose.override.yml
|
|
Dockerfile*
|
|
.dockerignore
|
|
|
|
# CI/CD
|
|
.github
|
|
|
|
# Documentation (built at runtime if needed)
|
|
docs/.vitepress/cache
|
|
docs/.vitepress/dist
|