Lucas RayanandClaude Opus 5
46d421c874
CI gains a security job (Trivy fs: vuln, secret and misconfig) and an
image job that builds each of the four services and scans the result. The
secret scanner earns its place here: a DKIM key or Cloudflare token
committed by accident is a full compromise of every domain served.
release.yml publishes on a merge into main and on v* tags. Four services
on two architectures is eight build jobs pushing by digest, then four
publish jobs joining each pair into one manifest list, tagged latest, sha
and semver. github.repository is lowercased first because GHCR rejects an
uppercase path and this repository is lucasrguerra/LambdaMail.
Both scanners failed on first run, so this commit also fixes what they
found rather than shipping a workflow that is red on arrival:
- All four images ran as root (DS-0002), which section 17 risk R5
explicitly argues against. They now run unprivileged; protocols keeps
its eight ports below 1024 through cap_net_bind_service on the binary
rather than through being root.
- A HIGH advisory in postcss, reached only through Next. "npm audit fix
--force" would have resolved it by downgrading Next from 15 to 9, so
it is pinned with an override instead.
- The Node images copied the build stage's node_modules wholesale,
shipping typescript, eslint and vitest into production, and the base
image's own bundled npm accounted for the rest of the CVEs. Runtime
dependencies now come from npm ci --omit=dev and npm is removed from
the final layer.
- compose-up could never have passed: the proxy network is external
because Coolify owns it on the deploy host, and nothing creates it in
CI, so compose refused to start the stack at all.
Verified locally: actionlint clean, all ten action refs confirmed to
exist, Trivy fs and all four image scans exit 0, the full stack reaches
Healthy on every container, and the containers run as uid 10001/1000 with
all eight privileged ports bound and SMTP answering on 25. The arm64
build itself is unverified - this machine has no buildx - and will first
be exercised by release.yml.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
41 lines
1.6 KiB
Docker
41 lines
1.6 KiB
Docker
FROM node:20-alpine AS build
|
|
WORKDIR /app
|
|
COPY package.json package-lock.json* ./
|
|
# npm ci, not npm install: the image must be the lockfile's content, not
|
|
# whatever resolves the day it is built.
|
|
RUN npm ci
|
|
COPY . .
|
|
RUN npm run build
|
|
|
|
# Production dependencies only. The previous image copied the build stage's
|
|
# node_modules wholesale, shipping typescript, eslint and vitest into
|
|
# production - most of the CVEs the image scan reported came from that
|
|
# tooling, which never runs in the container.
|
|
FROM node:20-alpine AS prod-deps
|
|
WORKDIR /app
|
|
COPY package.json package-lock.json* ./
|
|
RUN npm ci --omit=dev
|
|
|
|
FROM node:20-alpine
|
|
# The node:20-alpine tag lags its Alpine base, so pending security patches
|
|
# (openssl, busybox) land only with an explicit upgrade.
|
|
RUN apk upgrade --no-cache \
|
|
# The runtime only ever runs "node"; npm is not invoked and its own
|
|
# bundled dependency tree (sigstore, cross-spawn, glob, ...) is what
|
|
# every remaining image CVE came from. Removing it drops the whole
|
|
# class instead of chasing each advisory.
|
|
&& rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
|
|
WORKDIR /app
|
|
COPY --from=prod-deps /app/node_modules ./node_modules
|
|
COPY --from=build /app/dist ./dist
|
|
COPY package.json ./
|
|
|
|
# Created before dropping privileges so a fresh named volume mounted here
|
|
# inherits the ownership: Docker seeds an empty volume from the image.
|
|
RUN mkdir -p /var/lambdamail/mails && chown -R node:node /var/lambdamail
|
|
|
|
# The node images ship an unprivileged "node" user (uid 1000).
|
|
USER node
|
|
EXPOSE 3002
|
|
CMD ["node", "dist/server.js"]
|