From be8761a4279b3ac1e0a0f83b4373f2685c278d81 Mon Sep 17 00:00:00 2001 From: Julian Appel Date: Fri, 30 Oct 2026 23:03:35 +0100 Subject: [PATCH] Drop the unused npm CLI from the production image The runtime only starts node; the bundled npm carried HIGH findings in its own undici and brace-expansion copies. Co-Authored-By: Claude Opus 5.5 --- Dockerfile | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 66147e7..a2f62ca 100644 --- a/Dockerfile +++ b/Dockerfile @@ -50,7 +50,12 @@ ENV NODE_ENV=production ENV NEXT_TELEMETRY_DISABLED=1 WORKDIR /app COPY --from=build --chown=node:node /app ./ -RUN mkdir -p data && chown node:node data +# Zur Laufzeit startet nur node (compose.yaml), npm/npx/corepack werden nicht +# gebraucht. Ihr mitgeliefertes npm traegt eigene Abhaengigkeiten (z. B. +# undici, brace-expansion), die der Image-Scan sonst als HIGH meldet. +RUN mkdir -p data && chown node:node data \ + && rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack \ + /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack USER node EXPOSE 3000 3001 CMD ["node", "dist/server/index.js"]