-
Notifications
You must be signed in to change notification settings - Fork 4
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ORV2-1390 Puppetteer experiment #683
Changes from 12 commits
f815723
d8e75a4
8acf1e0
b54a56c
1c4478e
bbc906f
b09dc88
c584b94
5015770
a68371c
e0cd5d4
7190701
a900e47
7b90a67
719635d
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
This file was deleted.
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,32 +1,59 @@ | ||
# Build container | ||
FROM node:18.17.1-alpine AS builder | ||
FROM node:16.14.0 as builder | ||
|
||
|
||
RUN apt-get update | ||
|
||
# ENV NODE_VERSION=16.14.0 | ||
# RUN apt install -y curl | ||
# RUN curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash | ||
# ENV NVM_DIR=/root/.nvm | ||
# RUN . "$NVM_DIR/nvm.sh" && nvm install ${NODE_VERSION} | ||
# RUN . "$NVM_DIR/nvm.sh" && nvm use v${NODE_VERSION} | ||
# RUN . "$NVM_DIR/nvm.sh" && nvm alias default v${NODE_VERSION} | ||
# RUN chmod -R 777 /root/.nvm/versions/node/v${NODE_VERSION} | ||
# RUN echo $PATH | ||
# ENV PATH="/root/.nvm/versions/node/v${NODE_VERSION}/bin/:${PATH}" | ||
# RUN echo $PATH | ||
|
||
# Install packages, build and keep only prod packages | ||
WORKDIR /app | ||
COPY . ./ | ||
RUN apt-get update -y | ||
RUN apt-get install -y gconf-service libasound2 libatk1.0-0 libc6 \ | ||
libcairo2 libcups2 libdbus-1-3 libexpat1 libfontconfig1 libgcc1 \ | ||
libgconf-2-4 libgdk-pixbuf2.0-0 libglib2.0-0 libgtk-3-0 libnspr4 \ | ||
libpango-1.0-0 libpangocairo-1.0-0 libstdc++6 libx11-6 libx11-xcb1 \ | ||
libxcb1 libxcomposite1 libxcursor1 libxdamage1 libxext6 libxfixes3 \ | ||
libxi6 libxrandr2 libxrender1 libxss1 libxtst6 ca-certificates \ | ||
fonts-liberation libappindicator1 libnss3 lsb-release xdg-utils \ | ||
wget libgbm-dev gnupg gnupg2 gnupg1 | ||
Comment on lines
+22
to
+29
Check failure Code scanning / Trivy 'apt-get' missing '--no-install-recommends' High
Artifact: backend/dops/Dockerfile
Type: dockerfile Vulnerability DS029 Severity: HIGH Message: '--no-install-recommends' flag is missed: 'apt-get install -y gconf-service libasound2 libatk1.0-0 libc6 libcairo2 libcups2 libdbus-1-3 libexpat1 libfontconfig1 libgcc1 libgconf-2-4 libgdk-pixbuf2.0-0 libglib2.0-0 libgtk-3-0 libnspr4 libpango-1.0-0 libpangocairo-1.0-0 libstdc++6 libx11-6 libx11-xcb1 libxcb1 libxcomposite1 libxcursor1 libxdamage1 libxext6 libxfixes3 libxi6 libxrandr2 libxrender1 libxss1 libxtst6 ca-certificates fonts-liberation libappindicator1 libnss3 lsb-release xdg-utils wget libgbm-dev gnupg gnupg2 gnupg1' Link: DS029 |
||
|
||
# Set the working directory to /app inside the container | ||
WORKDIR /app | ||
|
||
# Copy app files | ||
COPY . ./ | ||
|
||
# Create and Assign permissions to npm folder | ||
RUN mkdir /.npm && chmod 777 /.npm | ||
|
||
# Install packages, build and keep only prod packages | ||
RUN npm ci | ||
RUN npm run build | ||
RUN npm prune --production | ||
|
||
|
||
|
||
# Deployment container | ||
FROM node:18.17.1-alpine | ||
RUN npm cache clean --force | ||
# Install Chrome version 114 | ||
ENV CHROME_VERSION="114.0.5735.133-1" | ||
RUN wget --no-verbose -O /tmp/chrome.deb https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${CHROME_VERSION}_amd64.deb \ | ||
&& apt install -y /tmp/chrome.deb \ | ||
&& rm /tmp/chrome.deb | ||
Comment on lines
+40
to
+42
Check notice Code scanning / Trivy RUN using 'wget' and 'curl' Low
Artifact: backend/dops/Dockerfile
Type: dockerfile Vulnerability DS014 Severity: LOW Message: Shouldn't use both curl and wget Link: DS014 |
||
|
||
# Create and Assign permissions to npm folder | ||
RUN mkdir /.npm && chmod 777 /.npm | ||
RUN mkdir /.cache && chmod 777 /.cache | ||
# Set up directories and adjust permissions | ||
RUN mkdir -p /root/.local/share/fonts \ | ||
&& mkdir -p /root/.config/puppeteer \ | ||
&& chmod -R 777 /root/.local \ | ||
&& chmod -R 777 /root/.config \ | ||
&& mkdir -p /.local \ | ||
&& chmod -R 777 /.local | ||
|
||
# Set the working directory to /app inside the deployment container | ||
WORKDIR /app | ||
RUN npm config set user 0 | ||
RUN npm config set unsafe-perm true | ||
RUN npm ci --only=prod && \ | ||
npm list rimraf && \ | ||
npm run build | ||
|
||
# Set node to production | ||
ENV NODE_ENV production | ||
|
@@ -60,24 +87,8 @@ | |
ENV CDOGS_URL ${CDOGS_URL} | ||
ENV ACCESS_API_URL ${ACCESS_API_URL} | ||
|
||
# Copy production files from build | ||
COPY --from=builder /app/package*.json ./ | ||
COPY --from=builder /app/node_modules ./node_modules | ||
COPY --from=builder /app/dist ./dist | ||
|
||
RUN apk add --no-cache \ | ||
chromium \ | ||
nss \ | ||
freetype \ | ||
harfbuzz \ | ||
ca-certificates \ | ||
ttf-freefont | ||
|
||
ENV PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser | ||
|
||
# Expose Port | ||
EXPOSE 5001 | ||
|
||
# Start the app | ||
CMD ["npm", "run", "start:prod"] | ||
|
||
# # Start up command | ||
ENTRYPOINT ["node","dist/main"] |
Check failure
Code scanning / Trivy
'RUN <package-manager> update' instruction alone High