2026-03-28 23:20:40 -05:00
|
|
|
FROM node:20-alpine
|
|
|
|
|
|
|
|
|
|
WORKDIR /app
|
|
|
|
|
|
fix: remaining security and deployment hardening (#6 #7 #10)
#7 Transport Security:
- Removed legacy _ssl_ctx alias from config.py
- proxy.py now uses _internal_ssl_ctx directly (explicitly scoped)
- No global TLS bypass remains
#10 Deployment Hardening:
- Inventory Dockerfile: non-root (node user), health check, production deps
- Budget Dockerfile: non-root (node user), health check, npm ci, multi-stage ready
- Frontend-v2 Dockerfile: multi-stage build, non-root (node user), health check
- Added /health endpoints to inventory and budget (before auth middleware)
- All 6 containers now run as non-root with health checks
All services verified: gateway, trips, fitness, inventory, budget, frontend
2026-03-29 09:35:39 -05:00
|
|
|
COPY package.json package-lock.json ./
|
|
|
|
|
RUN npm ci --production
|
2026-03-28 23:20:40 -05:00
|
|
|
|
|
|
|
|
COPY server.js ./
|
|
|
|
|
|
fix: remaining security and deployment hardening (#6 #7 #10)
#7 Transport Security:
- Removed legacy _ssl_ctx alias from config.py
- proxy.py now uses _internal_ssl_ctx directly (explicitly scoped)
- No global TLS bypass remains
#10 Deployment Hardening:
- Inventory Dockerfile: non-root (node user), health check, production deps
- Budget Dockerfile: non-root (node user), health check, npm ci, multi-stage ready
- Frontend-v2 Dockerfile: multi-stage build, non-root (node user), health check
- Added /health endpoints to inventory and budget (before auth middleware)
- All 6 containers now run as non-root with health checks
All services verified: gateway, trips, fitness, inventory, budget, frontend
2026-03-29 09:35:39 -05:00
|
|
|
RUN mkdir -p /app/data && chown -R node:node /app/data
|
2026-03-28 23:20:40 -05:00
|
|
|
|
|
|
|
|
EXPOSE 3001
|
fix: remaining security and deployment hardening (#6 #7 #10)
#7 Transport Security:
- Removed legacy _ssl_ctx alias from config.py
- proxy.py now uses _internal_ssl_ctx directly (explicitly scoped)
- No global TLS bypass remains
#10 Deployment Hardening:
- Inventory Dockerfile: non-root (node user), health check, production deps
- Budget Dockerfile: non-root (node user), health check, npm ci, multi-stage ready
- Frontend-v2 Dockerfile: multi-stage build, non-root (node user), health check
- Added /health endpoints to inventory and budget (before auth middleware)
- All 6 containers now run as non-root with health checks
All services verified: gateway, trips, fitness, inventory, budget, frontend
2026-03-29 09:35:39 -05:00
|
|
|
ENV NODE_ENV=production
|
2026-03-28 23:20:40 -05:00
|
|
|
|
fix: remaining security and deployment hardening (#6 #7 #10)
#7 Transport Security:
- Removed legacy _ssl_ctx alias from config.py
- proxy.py now uses _internal_ssl_ctx directly (explicitly scoped)
- No global TLS bypass remains
#10 Deployment Hardening:
- Inventory Dockerfile: non-root (node user), health check, production deps
- Budget Dockerfile: non-root (node user), health check, npm ci, multi-stage ready
- Frontend-v2 Dockerfile: multi-stage build, non-root (node user), health check
- Added /health endpoints to inventory and budget (before auth middleware)
- All 6 containers now run as non-root with health checks
All services verified: gateway, trips, fitness, inventory, budget, frontend
2026-03-29 09:35:39 -05:00
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD wget -qO- http://localhost:3001/health || exit 1
|
|
|
|
|
|
|
|
|
|
USER node
|
2026-03-28 23:20:40 -05:00
|
|
|
CMD ["node", "server.js"]
|
