Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ORV2-1390 Puppetteer experiment #683

Closed
wants to merge 15 commits into from
9 changes: 0 additions & 9 deletions backend/dops/.puppeteerrc.cjs

This file was deleted.

83 changes: 47 additions & 36 deletions backend/dops/Dockerfile
Original file line number Diff line number Diff line change
@@ -1,32 +1,59 @@
# Build container
FROM node:18.17.1-alpine AS builder
FROM node:16.14.0 as builder


RUN apt-get update

Check failure

Code scanning / Trivy

'RUN <package-manager> update' instruction alone High

Artifact: backend/dops/Dockerfile
Type: dockerfile
Vulnerability DS017
Severity: HIGH
Message: The instruction 'RUN update' should always be followed by ' install' in the same RUN statement.
Link: DS017
Fixed Show fixed Hide fixed
# ENV NODE_VERSION=16.14.0
# RUN apt install -y curl
# RUN curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash
# ENV NVM_DIR=/root/.nvm
# RUN . "$NVM_DIR/nvm.sh" && nvm install ${NODE_VERSION}
# RUN . "$NVM_DIR/nvm.sh" && nvm use v${NODE_VERSION}
# RUN . "$NVM_DIR/nvm.sh" && nvm alias default v${NODE_VERSION}
# RUN chmod -R 777 /root/.nvm/versions/node/v${NODE_VERSION}
# RUN echo $PATH
# ENV PATH="/root/.nvm/versions/node/v${NODE_VERSION}/bin/:${PATH}"
# RUN echo $PATH

# Install packages, build and keep only prod packages
WORKDIR /app
COPY . ./
RUN apt-get update -y
RUN apt-get install -y gconf-service libasound2 libatk1.0-0 libc6 \
libcairo2 libcups2 libdbus-1-3 libexpat1 libfontconfig1 libgcc1 \
libgconf-2-4 libgdk-pixbuf2.0-0 libglib2.0-0 libgtk-3-0 libnspr4 \
libpango-1.0-0 libpangocairo-1.0-0 libstdc++6 libx11-6 libx11-xcb1 \
libxcb1 libxcomposite1 libxcursor1 libxdamage1 libxext6 libxfixes3 \
libxi6 libxrandr2 libxrender1 libxss1 libxtst6 ca-certificates \
fonts-liberation libappindicator1 libnss3 lsb-release xdg-utils \
wget libgbm-dev gnupg gnupg2 gnupg1
Comment on lines +22 to +29

Check failure

Code scanning / Trivy

'apt-get' missing '--no-install-recommends' High

Artifact: backend/dops/Dockerfile
Type: dockerfile
Vulnerability DS029
Severity: HIGH
Message: '--no-install-recommends' flag is missed: 'apt-get install -y gconf-service libasound2 libatk1.0-0 libc6 libcairo2 libcups2 libdbus-1-3 libexpat1 libfontconfig1 libgcc1 libgconf-2-4 libgdk-pixbuf2.0-0 libglib2.0-0 libgtk-3-0 libnspr4 libpango-1.0-0 libpangocairo-1.0-0 libstdc++6 libx11-6 libx11-xcb1 libxcb1 libxcomposite1 libxcursor1 libxdamage1 libxext6 libxfixes3 libxi6 libxrandr2 libxrender1 libxss1 libxtst6 ca-certificates fonts-liberation libappindicator1 libnss3 lsb-release xdg-utils wget libgbm-dev gnupg gnupg2 gnupg1'
Link: DS029

# Set the working directory to /app inside the container
WORKDIR /app

# Copy app files
COPY . ./

# Create and Assign permissions to npm folder
RUN mkdir /.npm && chmod 777 /.npm

# Install packages, build and keep only prod packages
RUN npm ci
RUN npm run build
RUN npm prune --production



# Deployment container
FROM node:18.17.1-alpine
RUN npm cache clean --force
# Install Chrome version 114
ENV CHROME_VERSION="114.0.5735.133-1"
RUN wget --no-verbose -O /tmp/chrome.deb https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${CHROME_VERSION}_amd64.deb \
&& apt install -y /tmp/chrome.deb \
&& rm /tmp/chrome.deb
Comment on lines +40 to +42

Check notice

Code scanning / Trivy

RUN using 'wget' and 'curl' Low

Artifact: backend/dops/Dockerfile
Type: dockerfile
Vulnerability DS014
Severity: LOW
Message: Shouldn't use both curl and wget
Link: DS014

# Create and Assign permissions to npm folder
RUN mkdir /.npm && chmod 777 /.npm
RUN mkdir /.cache && chmod 777 /.cache
# Set up directories and adjust permissions
RUN mkdir -p /root/.local/share/fonts \
&& mkdir -p /root/.config/puppeteer \
&& chmod -R 777 /root/.local \
&& chmod -R 777 /root/.config \
&& mkdir -p /.local \
&& chmod -R 777 /.local

# Set the working directory to /app inside the deployment container
WORKDIR /app
RUN npm config set user 0
RUN npm config set unsafe-perm true
RUN npm ci --only=prod && \
npm list rimraf && \
npm run build

# Set node to production
ENV NODE_ENV production
Expand Down Expand Up @@ -60,24 +87,8 @@
ENV CDOGS_URL ${CDOGS_URL}
ENV ACCESS_API_URL ${ACCESS_API_URL}

# Copy production files from build
COPY --from=builder /app/package*.json ./
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/dist ./dist

RUN apk add --no-cache \
chromium \
nss \
freetype \
harfbuzz \
ca-certificates \
ttf-freefont

ENV PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser

# Expose Port
EXPOSE 5001

# Start the app
CMD ["npm", "run", "start:prod"]

# # Start up command
ENTRYPOINT ["node","dist/main"]
8 changes: 4 additions & 4 deletions backend/dops/openshift.deploy.yml
Original file line number Diff line number Diff line change
Expand Up @@ -19,13 +19,13 @@ parameters:
- name: DOMAIN
value: apps.silver.devops.gov.bc.ca
- name: CPU_REQUEST
value: "25m"
value: "100m"
- name: MEMORY_REQUEST
value: "50Mi"
value: "500Mi"
- name: CPU_LIMIT
value: "75m"
value: "900m"
- name: MEMORY_LIMIT
value: "150Mi"
value: "1Gi"
- name: MIN_REPLICAS
description: The minimum amount of replicas for the horizontal pod autoscaler.
value: "3"
Expand Down
Loading
Loading