security/dockerfile-hardening #2

Merged

jonathan merged 2 commits from security/dockerfile-hardening into update/packages-dependencies

2026-08-27 12:02:49 +02:00

jonathan commented

2026-08-27 12:02:40 +02:00

Owner

No description provided.

jonathan self-assigned this

2026-08-27 12:02:40 +02:00

jonathan added 2 commits

2026-08-27 12:02:40 +02:00

security: harden Docker image with Alpine 3.23 LTS and non-root user 25843590c4

- Upgrade base images: node:20-alpine -> node:20.20-alpine3.23 (LTS)
- Pin to specific Alpine 3.23 version for reproducible builds
- Add security updates in both build and runtime stages
- Add --chown=nobody:nobody to COPY commands for proper file permissions
- Run node process as non-root 'nobody' user (critical security improvement)
- Separate BUILD and RUNTIME stages with clear comments

Security Impact:
- Non-root user execution eliminates privilege escalation risks
- Alpine 3.23 includes latest security patches
- Pinned versions prevent unexpected dependency changes
- Smaller image size reduces attack surface compared to debian/bullseye

chore: remove VSCode settings file 1d65a3969a

jonathan merged commit 2e41849042 into update/packages-dependencies

2026-08-27 12:02:49 +02:00

jonathan deleted branch security/dockerfile-hardening

2026-08-27 12:02:49 +02:00

jonathan referenced this pull request from a commit

2026-08-27 12:02:50 +02:00

Merge pull request 'security/dockerfile-hardening' (#2) from security/dockerfile-hardening into update/packages-dependencies