Juno ChowandClaude Fable 5.1
9e54555009
- 升级含已知漏洞的间接依赖（fast-jwt、tar、nanoid、postcss 等），npm audit 清零， CI 增加 npm audit --audit-level=high 门禁 - TRUST_PROXY 支持跳数与 IP/CIDR 列表，不再只能信任全部上游；docker-compose 的 API 端口默认只绑定 127.0.0.1 - API 镜像以非 root 用户 node 运行，存储目录预先授权 - Node 版本声明改为 >=22，与生产镜像一致 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
34 lines
1.6 KiB
Docker
34 lines
1.6 KiB
Docker
FROM node:22-alpine AS deps
|
|
WORKDIR /app
|
|
COPY package.json package-lock.json ./
|
|
COPY apps/api/package.json apps/api/package.json
|
|
COPY packages/api-contracts/package.json packages/api-contracts/package.json
|
|
RUN npm ci --workspace apps/api --workspace packages/api-contracts --include-workspace-root=false
|
|
|
|
FROM deps AS build
|
|
COPY apps/api apps/api
|
|
COPY packages/api-contracts packages/api-contracts
|
|
RUN npm --workspace packages/api-contracts run build \
|
|
&& npm --workspace apps/api run build \
|
|
&& ./node_modules/.bin/esbuild apps/api/src/tools/importProviderOperationalUsage.ts \
|
|
--bundle --platform=node --format=esm --target=node22 \
|
|
--outfile=apps/api/dist/tools/importProviderOperationalUsage.bundle.mjs \
|
|
&& node --check apps/api/dist/tools/importProviderOperationalUsage.bundle.mjs
|
|
|
|
FROM node:22-alpine AS runtime
|
|
WORKDIR /app
|
|
ENV NODE_ENV=production
|
|
RUN apk add --no-cache ffmpeg
|
|
COPY package.json package-lock.json ./
|
|
COPY apps/api/package.json apps/api/package.json
|
|
COPY packages/api-contracts/package.json packages/api-contracts/package.json
|
|
RUN npm ci --workspace apps/api --workspace packages/api-contracts --include-workspace-root=false --omit=dev
|
|
COPY --from=build /app/packages/api-contracts/dist packages/api-contracts/dist
|
|
COPY --from=build /app/apps/api/dist apps/api/dist
|
|
COPY apps/api/migrations apps/api/migrations
|
|
# 以非 root 运行：本地存储目录预先创建并交给 node 用户，compose 挂载命名卷时会继承该属主。
|
|
RUN mkdir -p /app/storage && chown -R node:node /app
|
|
USER node
|
|
EXPOSE 4300
|
|
CMD ["npm", "--workspace", "apps/api", "run", "start"]
|