feat(dockerfile): added security layer, optimized image now 1.5GB on default

Author: Simen Daehlin

templates/Dockerfile.liquid

@@ -1,31 +1,36 @@
-{%- if packageManager == "yarn" %}
 FROM node:16-alpine
-# Installing libvips-dev for sharp Compatability
+# Installing libvips-dev for sharp Compatibility
 RUN apk update && apk add --no-cache build-base gcc autoconf automake zlib-dev libpng-dev nasm bash vips-dev
 ARG NODE_ENV=development
 ENV NODE_ENV=${NODE_ENV}
+RUN addgroup -g 1001 strapi && adduser -u 1001 -G strapi -s /bin/sh -D strapi
+
 WORKDIR /opt/
-COPY ./package.json ./yarn.lock ./
-ENV PATH /opt/node_modules/.bin:$PATH
-RUN yarn config set network-timeout 600000 -g && yarn install
-WORKDIR /opt/app
-COPY ./ .
-RUN yarn build
-EXPOSE 1337
-CMD ["yarn", "develop"]
+{%- if packageManager == "yarn" %}
+COPY package.json yarn.lock ./
 {%- else %}
-FROM node:16-alpine
-# Installing libvips-dev for sharp Compatability
-RUN apk update && apk add --no-cache build-base gcc autoconf automake zlib-dev libpng-dev nasm bash vips-dev
-ARG NODE_ENV=development
-ENV NODE_ENV=${NODE_ENV}
-WORKDIR /opt/
-COPY ./package.json ./package-lock.json ./
+COPY package.json package-lock.json ./
+{% endif %}
 ENV PATH /opt/node_modules/.bin:$PATH
-RUN npm install
+RUN chown -R strapi:strapi /opt/
+USER strapi{%- if packageManager == "yarn" %}
+COPY package.json yarn.lock ./
+RUN yarn config set network-timeout 600000 -g && yarn install --production
+{%- else %}
+COPY package.json package-lock.json ./
+RUN npm config set network-timeout 600000 -g && npm install --only=production
+{%- endif %}
+
 WORKDIR /opt/app
-COPY ./ .
-RUN npm run build
+COPY . .
+{%- if packageManager == "yarn" %}
+RUN ["yarn", "build"]
+{%- else %}
+RUN ["npm", "run","build"]
+{%- endif %}
 EXPOSE 1337
-CMD ["npm", "run", "develop"]
-{% endif %}
+{%- if packageManager == "yarn" %}
+CMD ["yarn", "start"]
+{%- else %}
+CMD ["npm", "run","develop"]
+{% endif %}