Skip to content

Commit 3178e47

Browse files
authored
Switch to distroless image (#473)
* switch to distroless image * update docker build/run commands and envvars * remove commented code * use nonroot image * make write perms more fine grained
1 parent 30f521c commit 3178e47

File tree

5 files changed

+25
-30
lines changed

5 files changed

+25
-30
lines changed

.dockerignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Dockerfile
2+
node_modules/
3+
tests/

Dockerfile

Lines changed: 9 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -4,34 +4,18 @@ RUN apk add pnpm
44

55
COPY . .
66

7-
RUN rm -rf node_modules && \
8-
pnpm install && pnpm run build
9-
10-
FROM node:20-alpine
11-
12-
# Create a user with a specific UID, GID, and home directory
13-
ARG USERNAME=appuser
14-
ARG UID=1001
15-
ARG GID=1001
16-
ARG HOME_DIR=/home/appuser
17-
18-
RUN addgroup -g ${GID} ${USERNAME}
19-
RUN adduser -D -u ${UID} -G ${USERNAME} -h ${HOME_DIR} ${USERNAME}
20-
RUN mkdir -p ${HOME_DIR} && chown -R ${UID}:${GID} ${HOME_DIR}
21-
WORKDIR ${HOME_DIR}/app
22-
23-
COPY --from=builder /usr/local/app/dist ${HOME_DIR}/app/dist
24-
COPY package*.json server.js ./
25-
26-
# Ensure appuser owns all files in /home/appuser/app
27-
RUN chown -R ${UID}:${GID} ${HOME_DIR}/app
7+
RUN pnpm install && pnpm run build
8+
RUN pnpm install --ignore-scripts vite-express
289

29-
RUN apk add pnpm
30-
USER ${USERNAME}
10+
FROM gcr.io/distroless/nodejs20-debian12:debug-nonroot
3111

32-
RUN pnpm install --ignore-scripts vite-express
12+
COPY --from=builder --chown=nonroot:nonroot --chmod=777 /usr/local/app/dist /app/dist/
13+
COPY --from=builder --chown=nonroot:nonroot --chmod=555 /usr/local/app/node_modules /app/node_modules
14+
COPY --from=builder --chown=nonroot:nonroot --chmod=555 /usr/local/app/package*.json /usr/local/app/server.js /app/
3315

16+
WORKDIR /app
17+
ENV NODE_ENV=production
3418
ENV PORT=8080
3519
EXPOSE 8080
3620

37-
ENTRYPOINT ["sh", "-c", "./dist/vite-envs.sh && npm run prod"]
21+
ENTRYPOINT ["sh", "-c", "/busybox/sh ./dist/vite-envs.sh && /nodejs/bin/node server.js"]

Makefile

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ help:
1010
build: ## Build the app
1111
pnpm install
1212

13-
.PHONY: run-dev
13+
.PHONY: run-dev
1414
run-dev: ## Run the app in dev mode
1515
pnpm run dev
1616

@@ -34,9 +34,9 @@ develop: ## Start the nix development shell
3434

3535
.PHONY: build-local-docker
3636
build-docker-local: ## Build the docker container
37-
docker build -t dapla-ctrl .
37+
docker build --platform linux/amd64 -t dapla-ctrl:latest .
3838

3939
include .env.local
4040
.PHONY: run-docker-local
4141
run-docker-local: ## Run the docker container
42-
docker run -it -p 8080:8080 -e VITE_JWKS_URI=${VITE_JWKS_URI} dapla-ctrl
42+
./bin/run-docker.sh

bin/run-docker.sh

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
docker run --platform linux/amd64 \
2+
--rm -it \
3+
-p3000:3000 \
4+
-e PORT=3000 \
5+
-e DAPLA_TEAM_API_URL=https://dapla-team-api.intern.test.ssb.no \
6+
-e DAPLA_CTRL_ADMIN_GROUPS=dapla-stat-developers,dapla-skyinfra-developers \
7+
-e DAPLA_CTRL_DOCUMENTATION_URL=https://manual.dapla.ssb.no/statistikkere/dapla-ctrl.html \
8+
dapla-ctrl:latest

flake.nix

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@
1818
shellHook = ''
1919
export DAPLA_TEAM_API_URL=https://dapla-team-api.intern.test.ssb.no
2020
export PORT=3000
21-
export DAPLA_CTRL_ADMIN_GROUPS=dapla-stat-developers,dapla-skyinfra-developers,dapla-utvik-developers
22-
export DAPLA_CTRL_DOCUMENTATION_URL=https://statistics-norway.atlassian.net/wiki/x/EYC24g
21+
export DAPLA_CTRL_ADMIN_GROUPS=dapla-stat-developers,dapla-skyinfra-developers
22+
export DAPLA_CTRL_DOCUMENTATION_URL=https://manual.dapla.ssb.no/statistikkere/dapla-ctrl.html
2323
'';
2424
packages = with pkgs; [
2525
nixd

0 commit comments

Comments
 (0)