Grovy311/leistungsbilanz-ts
1
0
Fork 0
forked from jappel/leistungsbilanz-ts
Code Pull requests Activity

Drop the unused npm CLI from the production image

Browse source 
The runtime only starts node; the bundled npm carried HIGH findings in its
own undici and brace-expansion copies.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Julian Appel 2026-10-30 23:03:35 +01:00
parent fd7dcbb100
commit be8761a427
1 changed files with 6 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
Dockerfile
View file

@ -50,7 +50,12 @@ ENV NODE_ENV=production
ENV NEXT_TELEMETRY_DISABLED=1
WORKDIR /app
COPY --from=build --chown=node:node /app ./
RUN mkdir -p data && chown node:node data
# Zur Laufzeit startet nur node (compose.yaml), npm/npx/corepack werden nicht
# gebraucht. Ihr mitgeliefertes npm traegt eigene Abhaengigkeiten (z. B.
# undici, brace-expansion), die der Image-Scan sonst als HIGH meldet.
RUN mkdir -p data && chown node:node data \
&& rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack \
/usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack
USER node
EXPOSE 3000 3001
CMD ["node", "dist/server/index.js"]