feat(docker): reduce base image vulnerabilities

[bzp2010]

Description

Switch the base image to gcr.io/distroless/nodejs24-debian13:nonroot. This will reduce the number of vulnerabilities in the base image to 0, and since ADC itself does not introduce any vulnerabilities, all vulnerabilities have been eliminated.

The trade-off is that the image now does not include any shell, package manager, or unnecessary packages. Therefore, it is no longer possible to use commands like docker exec to access the container shell for debugging. However, launching the inspector using Node.js options is still possible.

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible

Summary by CodeRabbit

• Refactor
  • Updated the application’s runtime container to use a slimmer, security-focused base image.
  • Preserved existing startup behavior while improving the production container setup.

[coderabbitai]

📝 Walkthrough

Walkthrough

The Dockerfile runtime stage now uses a non-root distroless Node.js 24 image, preserves the built application copy, and invokes main.cjs through the distroless Node binary path.

Changes

Docker runtime image

Layer / File(s)	Summary
Distroless runtime entrypoint libs/tools/src/docker/Dockerfile	The final stage uses gcr.io/distroless/nodejs24-debian13:nonroot and runs main.cjs with /nodejs/bin/node.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: juzhiyuan

🚥 Pre-merge checks | ✅ 5 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
E2e Test Quality Review	⚠️ Warning	The PR only swaps the Docker base image; it adds no container-level E2E/smoke test, so the new distroless entrypoint and runtime aren’t validated.	Add an image smoke test (build + docker run/CLI invocation) that exercises the distroless container startup and CLI help path.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: switching the Docker base image to reduce vulnerabilities.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Security Check	✅ Passed	Only a Dockerfile base-image/entrypoint swap changed; no logging, auth, secret-storage, TLS, or ownership code was touched, and distroless/nonroot reduces attack surface.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bzp/feat-docker-distroless

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (2)

libs/tools/src/docker/Dockerfile (2)

16-20: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Keep builder and runtime Node versions aligned.

The builder still tracks node:lts-bookworm-slim, while the runtime is fixed to Node 24. When LTS advances, build-time and runtime Node versions may diverge, undermining backward compatibility. Pin the builder to Node 24 or share one NODE_VERSION argument across both stages.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@libs/tools/src/docker/Dockerfile` around lines 16 - 20, Align the builder
stage’s Node image with the Node 24 distroless runtime by updating its base
image or introducing a shared NODE_VERSION build argument used by both stages.
Preserve the existing build and runtime commands while ensuring they always use
the same major Node version.

---

16-16: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Pin and verify the distroless base image.

The mutable :nonroot tag can silently change runtime contents, making vulnerability results and rollbacks non-reproducible. Prefer a digest-pinned image with automated digest updates and signature verification. Distroless documents Cosign verification for its images. (github.com)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@libs/tools/src/docker/Dockerfile` at line 16, Update the Dockerfile’s
distroless base image reference to use a verified immutable digest instead of
the mutable :nonroot tag. Configure the repository’s existing image-update
automation to track and refresh that digest, and add the applicable Cosign
signature verification step for the pinned distroless image.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@libs/tools/src/docker/Dockerfile`:
- Around line 16-20: Align the builder stage’s Node image with the Node 24
distroless runtime by updating its base image or introducing a shared
NODE_VERSION build argument used by both stages. Preserve the existing build and
runtime commands while ensuring they always use the same major Node version.
- Line 16: Update the Dockerfile’s distroless base image reference to use a
verified immutable digest instead of the mutable :nonroot tag. Configure the
repository’s existing image-update automation to track and refresh that digest,
and add the applicable Cosign signature verification step for the pinned
distroless image.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 69cb7db3-7648-4fda-bccc-91d95dbfe8a7

📥 Commits

Reviewing files that changed from the base of the PR and between 7276bdf and 7318697.

📒 Files selected for processing (1)

• libs/tools/src/docker/Dockerfile