diff --git a/Dockerfile b/Dockerfile index e00c25f..b7b7457 100644 --- a/Dockerfile +++ b/Dockerfile @@ -7,15 +7,14 @@ # the Business Source License, use of this software will be governed # by the Apache License, Version 2.0 -FROM node:16-alpine +FROM node:17-alpine ARG LOCAL_USER_ID ARG LOCAL_GROUP_ID # Create an environment variable in our image for the non-root user we want to use. # ENV USER 1000 -ENV USER orchestrator -ENV GROUP purpleteam +ENV USER=orchestrator GROUP=purpleteam RUN echo user is: ${USER}, LOCAL_USER_ID is: ${LOCAL_USER_ID}, group is: ${GROUP}, LOCAL_GROUP_ID is: ${LOCAL_GROUP_ID} RUN apk add --no-cache zip # Following taken from: https://github.com/mhart/alpine-node/issues/48#issuecomment-430902787 @@ -36,7 +35,7 @@ RUN apk add --no-cache shadow && \ # echo "$USER ALL=(root) NOPASSWD:ALL" > /etc/sudoers.d/$USER && \ # chmod 0440 /etc/sudoers.d/$USER -ENV WORKDIR /usr/src/app/ +RUN mkdir -p /usr/src/app/ && chown $USER:$GROUP --recursive /usr/src/app/ # Home is required for npm install. System account with no ability to login to shell # For standard node image: @@ -44,7 +43,7 @@ ENV WORKDIR /usr/src/app/ # For node alpine: # RUN addgroup -S $USER && adduser -S $USER -G $GROUP -RUN mkdir -p $WORKDIR && chown $USER:$GROUP --recursive $WORKDIR +WORKDIR /usr/src/app/ #RUN cat /etc/resolv.conf #RUN echo "" > /etc/resolv.conf @@ -54,16 +53,15 @@ RUN mkdir -p $WORKDIR && chown $USER:$GROUP --recursive $WORKDIR #RUN apk add --no-cache --virtual .gyp python make g++ #RUN apk add --no-cache --virtual .gyp python -WORKDIR $WORKDIR # For npm@5 or later, copy the automatically generated package-lock.json instead. -COPY package*.json $WORKDIR +COPY package*.json /usr/src/app/ # Required if posix needed, for winston-syslog-posix #RUN apk add --no-cache --virtual .gyp python make g++ # In a cloud build, add the --cloud flag, as in: #RUN cd $WORKDIR; npm install --cloud -RUN cd $WORKDIR && npm install +RUN npm install # Required if posix needed, for winston-syslog-posix #User root @@ -72,7 +70,7 @@ RUN cd $WORKDIR && npm install # String expansion doesn't work currently: https://github.com/moby/moby/issues/35018 # COPY --chown=${USER}:GROUP . $WORKDIR -COPY --chown=orchestrator:purpleteam . $WORKDIR +COPY --chown=orchestrator:purpleteam . /usr/src/app/ # Here I used to chown and chmod as shown here: http://f1.holisticinfosecforwebdevelopers.com/chap03.html#vps-countermeasures-docker-the-default-user-is-root # Problem is, each of these commands creates another layer of all the files modified and thus adds over 100MB to the image: https://www.datawire.io/not-engineer-running-3-5gb-docker-images/