security/dockerfile-hardening #4

Merged

jonathan merged 2 commits from security/dockerfile-hardening into master

2026-08-26 12:41:36 +02:00

jonathan commented

2026-08-26 12:41:26 +02:00

Owner

No description provided.

jonathan self-assigned this

2026-08-26 12:41:27 +02:00

jonathan added 2 commits

2026-08-26 12:41:27 +02:00

security: harden Docker image with Alpine security updates and non-root user ad8c8b9dde

- Upgrade base images: node:18-alpine -> node:20.20-alpine3.23 (LTS)
- Upgrade nginx: 1.25-alpine -> 1.31-alpine3.23 (latest stable)
- Pin to specific Alpine 3.23 version for reproducible builds
- Add security updates in both build and runtime stages
- Use npm ci --frozen-lockfile for deterministic dependencies
- Add --chown=nginx:nginx to COPY command for proper file permissions
- Run nginx container as non-root 'nginx' user (critical security improvement)
- Improve build structure with explicit BUILD and RUNTIME comments

Security Impact:
- Non-root user execution reduces privilege escalation risk
- Deterministic builds prevent supply chain attacks
- Alpine 3.23 includes latest security patches
- Smaller image size reduces attack surface

security: already committed to this branch 9a00850b78

jonathan merged commit 8229ec60be into master

2026-08-26 12:41:36 +02:00

jonathan deleted branch security/dockerfile-hardening

2026-08-26 12:41:36 +02:00

jonathan referenced this pull request from a commit

2026-08-26 12:41:37 +02:00

Merge pull request 'security/dockerfile-hardening' (#4) from security/dockerfile-hardening into master