Skip to content

Use node least privilidged user, set NODE_ENV to production #256

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Mar 13, 2024
Merged

Use node least privilidged user, set NODE_ENV to production #256

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
21ec2d3
Use node least privilidged user, set NODE_ENV to production
Siegrift Mar 11, 2024
8faddc2
Fix Dockerfile issues
Siegrift Mar 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 13 additions & 15 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,19 +41,16 @@ FROM build AS deployed-airnode-feed
RUN pnpm --filter=@api3/airnode-feed --prod deploy deployed-airnode-feed
FROM node:20-slim as airnode-feed
WORKDIR /app
ENV NODE_ENV=production

# Update package lists and install wget
RUN apt-get update && \
apt-get install --no-install-recommends -y wget ca-certificates && \
rm -rf /var/lib/apt/lists/*

RUN addgroup --system deployed-airnode-feed && \
adduser --home /app --shell /bin/false --system --disabled-password --ingroup deployed-airnode-feed deployed-airnode-feed && \
chown --recursive deployed-airnode-feed:deployed-airnode-feed /app
USER deployed-airnode-feed

COPY --chown=deployed-airnode-feed:deployed-airnode-feed --from=deployed-airnode-feed /app/deployed-airnode-feed .
RUN chown --recursive node:node /app
COPY --chown=node:node --from=deployed-airnode-feed /app/deployed-airnode-feed .
USER node
ENV NODE_ENV=production
ENTRYPOINT ["node", "dist/src/index.js"]

# Create a separate stage for signed-api package. We create a temporary stage for deployment and then copy the result
Expand All @@ -65,7 +62,11 @@ FROM build AS deployed-signed-api
RUN pnpm --filter=@api3/signed-api --prod deploy deployed-signed-api
FROM node:20-slim as signed-api
WORKDIR /app
ENV NODE_ENV=production

# Update package lists and install wget
RUN apt-get update && \
Copy link
Collaborator Author

@Siegrift Siegrift Mar 13, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When testing the package I realized this is missing in the Signed API image. So 0.5.x, 0.6.0 and 0.7.0 Signed API is broken if it tries to fetch the Signed API config via wget (because it's missing in the image). This was a remnant of changing the base image from alpine to slim.

We are not using wget in Nodary nor API3 deployments, so we are not affected by this.

apt-get install --no-install-recommends -y wget ca-certificates && \
rm -rf /var/lib/apt/lists/*

# Update package lists and install libcap
RUN apt-get update && \
Expand All @@ -74,11 +75,8 @@ RUN apt-get update && \
# Set capabilities to allow Node.js to bind to well-known ports (<1024) as a non-root user
RUN setcap 'cap_net_bind_service=+ep' /usr/local/bin/node


RUN addgroup --system deployed-signed-api && \
adduser --home /app --shell /bin/false --system --disabled-password --ingroup deployed-signed-api deployed-signed-api && \
chown --recursive deployed-signed-api:deployed-signed-api /app
USER deployed-signed-api

COPY --chown=deployed-signed-api:deployed-signed-api --from=deployed-signed-api /app/deployed-signed-api .
RUN chown --recursive node:node /app
COPY --chown=node:node --from=deployed-signed-api /app/deployed-signed-api .
USER node
ENV NODE_ENV=production
ENTRYPOINT ["node", "dist/src/index.js"]