build(docker): Switch to Docker Hardened Images (DHI)

[oioki]

Attempt 3 of #212

Previous attempts failed due to:

• failing acceptance test (fixed in healthcheck)
• missing fonts (caused inc-2061)

Switch both builder and runtime stages to Docker Hardened Images (DHI).

Before: builder and runtime both used node:24.14.0/node:24.14.0-slim (Debian 12), with canvas system libraries installed via apt-get in the runtime. Trivy reported 1,457 vulnerabilities (3 CRITICAL, 148 HIGH) across 288 OS packages, compressed image size ~502 MB.

After: builder uses us-docker.pkg.dev/sentryio/dhi/node:24-debian13-dev, runtime uses the minimal us-docker.pkg.dev/sentryio/dhi/node:24-debian13 (Debian 13, distroless — no shell, no apt). Trivy reports 10 vulnerabilities (0 CRITICAL, 1 HIGH) across 12 OS packages, compressed image size ~83 MB.

  ┌────────────────┬────────────────────────────────────────┬─────────────────────────────┬────────┐
  │     Metric     │       Before (node:24.14.0-slim)       │         After (DHI          │ Change │
  │                │                                        │      node:24-debian13)      │        │
  ├────────────────┼────────────────────────────────────────┼─────────────────────────────┼────────┤
  │ Compressed     │ ~502 MB                                │ ~83 MB                      │ −83%   │
  │ size           │                                        │                             │        │
  ├────────────────┼────────────────────────────────────────┼─────────────────────────────┼────────┤
  │ OS             │ Debian 12.13 (bookworm)                │ Debian 13.3 (trixie)        │        │
  ├────────────────┼────────────────────────────────────────┼─────────────────────────────┼────────┤
  │ OS packages    │ 288                                    │ 12                          │ −96%   │
  ├────────────────┼────────────────────────────────────────┼─────────────────────────────┼────────┤
  │ OS vulns       │ 1455 (C:3 H:148 M:659 L:644 U:1)       │ 10 (C:0 H:1 M:2 L:7)        │ −99%   │
  ├────────────────┼────────────────────────────────────────┼─────────────────────────────┼────────┤
  │ npm vulns      │ 2 HIGH (minimatch                      │ 0                           │ −100%  │
  │                │ CVE-2026-27903/27904)                  │                             │        │
  ├────────────────┼────────────────────────────────────────┼─────────────────────────────┼────────┤
  │ Total vulns    │ 1457                                   │ 10                          │ −99%   │
  └────────────────┴────────────────────────────────────────┴─────────────────────────────┴────────┘

How the builder conflict was resolved

DHI's pre-installed libexpat1 2.7.4 (arch:all) conflicts with canvas's build dependencies (libcairo2-dev → libfontconfig-dev → libexpat1-dev requires exactly libexpat1 = 2.7.1-2). This turned out not to matter: canvas 3.x uses node-pre-gyp to download pre-built binaries at install time, so no system canvas libraries are needed in the builder at all.

How the minimal runtime was made to work

canvas 3.x bundles all its graphics libs (libcairo, libpango, librsvg, etc.) in node_modules/canvas/build/Release/, so no system canvas libraries are needed at runtime either. However, the bundled libs still need some basic system libs absent from the distroless image. Rather than maintaining a hand-picked list that could silently go stale when canvas or another native module is updated, the builder uses ldd to auto-detect all transitive system dependencies of every .node file and collects them into /canvas-sys-libs/. These are then copied into the runtime with COPY --from=builder /canvas-sys-libs/usr/lib/ /usr/lib/.

canvas also bundles libfontconfig.so.1 but needs /etc/fonts/fonts.conf to initialise — without it all chart text renders as box glyphs. fontconfig is installed in the builder (which also pulls in fonts-dejavu-core as a dependency), and /etc/fonts/ and /usr/share/fonts/ are copied into the runtime as plain files. They do not appear as installed packages in the runtime image, hence 12 OS packages rather than the 24 in the previous build.

Build-time smoke test

The runtime stage runs smoketest.js as a RUN step (exec form, since the minimal image has no shell). It exercises the full rendering pipeline — canvas init, font loading, echarts render, PNG output — and compares the result byte-for-byte against a pinned SHA-256 hash of the known-good output.

This catches two classes of failure at build time rather than in production:

• Hard failures (crash/exception): missing .so file, fontconfig not initialised, etc.
• Silent corruption: a technically valid PNG that renders box glyphs or wrong pixels — the kind that would pass a magic-bytes check but was exactly the failure mode that caused inc-2061

The render is deterministic: identical input spec → identical bytes across repeated runs and separate container invocations (verified). When intentionally changing the chart spec, the file includes instructions to regenerate the expected hash.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}