Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(docker): Apply OWASP recommendations #455

Merged
merged 22 commits into from
May 15, 2021
Merged

fix(docker): Apply OWASP recommendations #455

merged 22 commits into from
May 15, 2021

Conversation

adrienjoly
Copy link
Member

@adrienjoly adrienjoly commented May 14, 2021 •
edited
Loading

@adrienjoly adrienjoly self-assigned this May 14, 2021
@adrienjoly
ensure that we only install production dependencies in a deterministi…
26a63ff 
…c way
@adrienjoly
set NODE_ENV
e01f235
@adrienjoly
Don’t run containers as root
38865b6
@adrienjoly
troubleshooting: display openwhyd logs after tests fail
a65161e
@adrienjoly
try to fix "permission denied, open './playlog.json.log'"
25ff239 
cf https://github.com/openwhyd/openwhyd/pull/455/checks?check_run_id=2583057189#step:7:27
@adrienjoly
try to allow "node" user to create files in that directory (e.g. play…
2d0d150 
…log.json.log)
@adrienjoly
add group
755d42e
@adrienjoly
don't set file perms
03ecb9f
@adrienjoly
create the dir ourselves nodejs/docker-node#740 (comment)
6d7618a
@adrienjoly
move workdir to /home, so node can write files
ea6ad48
@adrienjoly
chown
82b0830
@adrienjoly
faster chown
fa49495
@adrienjoly
cleanup comments from analytics.js
c8de775
@adrienjoly
Properly handle events to safely terminate a Node.js Docker web appli…
6dc22c8 
…cation
@adrienjoly
terminate gracefully (1)
dfad355
@adrienjoly
terminate gracefully on SIGINT and SIGTERM
14e0c1c
@adrienjoly
multi-stage build
a2760a1
@adrienjoly
fix separation of parameters in CMD
779df76
@adrienjoly
ignore more files
e68953c
@adrienjoly
fix `chown: changing ownership of '/usr/src/app': Operation not permi…
c02341c 
…tted`

cf https://github.com/openwhyd/openwhyd/runs/2589782153#step:3:655
@adrienjoly
Copy link
Member Author

adrienjoly commented May 15, 2021 •
edited
Loading

Bonus: smaller image !

  • before:
docker image ls openwhyd_web 
REPOSITORY     TAG       IMAGE ID       CREATED          SIZE
openwhyd_web   latest    eecce57190b1   43 seconds ago   482MB
  • after:
$ docker image ls openwhyd_web 
REPOSITORY     TAG       IMAGE ID       CREATED              SIZE
openwhyd_web   latest    ed82a011d735   About a minute ago   296MB

EDIT: resulting compressed image on docker hub:

@adrienjoly adrienjoly marked this pull request as ready for review May 15, 2021 09:30
@adrienjoly adrienjoly merged commit 5507606 into master May 15, 2021
@adrienjoly adrienjoly deleted the fix/dockerfile branch May 15, 2021 09:32
adrienjoly pushed a commit that referenced this pull request May 15, 2021
@semantic-release-bot
chore(release): 1.44.41 [skip ci]
2282dab 
## [1.44.41](v1.44.40...v1.44.41) (2021-05-15)

### Bug Fixes

* **docker:** Apply OWASP recommendations ([#455](#455)) ([5507606](5507606))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@adrienjoly adrienjoly

Labels
enhancement production security / privacy
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
1 participant
@adrienjoly