Utilise la version 'hardened' de l'image Node 24

graphql/app.js

@@ -1,10 +1,12 @@
 const Sentry = require('@sentry/node')
 const { nodeProfilingIntegration } = require('@sentry/profiling-node')
-const pkg = require('./package.json')
 const process = require('node:process')
 const debounce = require('lodash.debounce')
-const config = require('./config.js')
 const proxy = require('express-http-proxy')
+const migrate = require('db-migrate')
+
+const pkg = require('./package.json')
+const config = require('./config.js')
 
 config.validate({ allowed: 'strict' })
 
@@ -343,19 +345,30 @@ yjsUtils.setPersistence({
 })
 wss.on('connection', yjsUtils.setupWSConnection)
 
-const server = app.listen(config.get('port'), (err) => {
-  if (err) {
-    logger.error({ err }, 'Unable to connect to MongoDB.')
-    throw err
+const migrateInstance = migrate.getInstance(true)
+
+;(async () => {
+  try {
+    await migrateInstance.up()
+  } catch (err) {
+    logger.error({ err }, 'Migrations failed.')
+    process.exit(1)
   }
 
-  logger.info('Listening on http://localhost:%s', config.get('port'))
-})
+  const server = app.listen(config.get('port'), (err) => {
+    if (err) {
+      logger.error({ err }, 'Unable to connect to MongoDB.')
+      throw err
+    }
 
-server.on('upgrade', (request, socket, head) => {
-  wss.handleUpgrade(request, socket, head, function handleAuth(ws) {
-    // const jwtToken = new URL('http://localhost' + request.url).searchParams.get("token")
-    // TODO: check token and permissions
-    wss.emit('connection', ws, request)
+    logger.info('Listening on http://localhost:%s', config.get('port'))
   })
-})
+
+  server.on('upgrade', (request, socket, head) => {
+    wss.handleUpgrade(request, socket, head, function handleAuth(ws) {
+      // const jwtToken = new URL('http://localhost' + request.url).searchParams.get("token")
+      // TODO: check token and permissions
+      wss.emit('connection', ws, request)
+    })
+  })
+})()

graphql/dockerfile

@@ -1,15 +1,23 @@
-FROM node:24-alpine
+FROM dhi.io/node:24-alpine3.23-dev AS build-stage
 
+ENV NODE_ENV="production"
 WORKDIR /usr/src/app
 
 COPY package*.json ./
 
-RUN npm clean-install
+RUN npm clean-install --omit=dev
 
-COPY . .
+FROM dhi.io/node:24-alpine3.23 AS runtime-stage
 
 ENV NODE_ENV="production"
+WORKDIR /usr/src/app
+
+COPY --from=build-stage /usr/src/app/node_modules ./node_modules
+
+COPY package*.json ./
+COPY . .
+
 EXPOSE 3030
 
-CMD ["npm", "run", "prod"]
+CMD ["node", "--tls-max-v1.2", "--heapsnapshot-signal=SIGUSR2", "app.js"]
 

graphql/package.json

@@ -14,9 +14,7 @@
     "test": "c8 --reporter=lcov node --test **/*.test.js",
     "migrations": "DOTENV_CONFIG_PATH=${DOTENV_CONFIG_PATH:-../.env} node -r dotenv/config ./node_modules/.bin/db-migrate up",
     "posttest": "eslint '**/*.js'",
-    "prestart": "npm run migrations",
     "start": "node app.js",
-    "preprod": "npm run migrations",
     "prod": "NODE_ENV=production node --tls-max-v1.2 --heapsnapshot-signal=SIGUSR2 app.js"
   },
   "author": "",