Merge pull request #76 from strapi-community/feature/security-dockerfiles

Feature/security dockerfiles

Author: Eventyret

templates/Dockerfile-prod.liquid

@@ -1,53 +1,43 @@
-{%- if packageManager == "yarn" %}
+# Creating multi-stage build for production
 FROM node:16-alpine as build
-# Installing libvips-dev for sharp Compatability
 RUN apk update && apk add --no-cache build-base gcc autoconf automake zlib-dev libpng-dev vips-dev > /dev/null 2>&1
 ARG NODE_ENV=production
 ENV NODE_ENV=${NODE_ENV}
-WORKDIR /opt/
-COPY ./package.json ./yarn.lock ./
-ENV PATH /opt/node_modules/.bin:$PATH
-RUN yarn config set network-timeout 600000 -g && yarn install --production
-WORKDIR /opt/app
-COPY ./ .
-RUN yarn build
 
-FROM node:16-alpine
-RUN apk add --no-cache vips-dev
-ARG NODE_ENV=production
-ENV NODE_ENV=${NODE_ENV}
 WORKDIR /opt/
-COPY --from=build /opt/node_modules ./node_modules
-ENV PATH /opt/node_modules/.bin:$PATH
-WORKDIR /opt/app
-COPY --from=build /opt/app ./
-EXPOSE 1337
-CMD ["yarn", "start"]
-
+{%- if packageManager == "yarn" %}
+COPY package.json yarn.lock ./
+RUN yarn config set network-timeout 600000 -g && yarn install --production
 {%- else %}
-FROM node:16-alpine as build
-# Installing libvips-dev for sharp Compatability
-RUN apk update && apk add --no-cache build-base gcc autoconf automake zlib-dev libpng-dev vips-dev > /dev/null 2>&1
-ARG NODE_ENV=production
-ENV NODE_ENV=${NODE_ENV}
-WORKDIR /opt/
-COPY ./package.json ./package-lock.json ./
+COPY package.json package-lock.json ./
+RUN npm config set network-timeout 600000 -g && npm install --only=production
+{%- endif %}
 ENV PATH /opt/node_modules/.bin:$PATH
-RUN npm install --production
 WORKDIR /opt/app
-COPY ./ .
+COPY . .
+{%- if packageManager == "yarn" %}
+RUN yarn build
+{%- else %}
 RUN npm run build
+{%- endif %}
 
+# Creating final production image
 FROM node:16-alpine
-# Installing libvips-dev for sharp Compatability
+RUN addgroup -g 1001 strapi && adduser -u 1001 -G strapi -s /bin/sh -D strapi
 RUN apk add --no-cache vips-dev
 ARG NODE_ENV=production
 ENV NODE_ENV=${NODE_ENV}
 WORKDIR /opt/
 COPY --from=build /opt/node_modules ./node_modules
-ENV PATH /opt/node_modules/.bin:$PATH
 WORKDIR /opt/app
 COPY --from=build /opt/app ./
+ENV PATH /opt/node_modules/.bin:$PATH
+
+RUN chown -R strapi:strapi /opt/app
+USER strapi
 EXPOSE 1337
-CMD ["npm", "run","start"]
-{% endif %}
+{%- if packageManager == "yarn" %}
+CMD ["yarn", "start"]
+{%- else %}
+CMD ["npm", "run", "start"]
+{%- endif %}

templates/Dockerfile.liquid

@@ -1,31 +1,35 @@
-{%- if packageManager == "yarn" %}
 FROM node:16-alpine
-# Installing libvips-dev for sharp Compatability
+# Installing libvips-dev for sharp Compatibility
 RUN apk update && apk add --no-cache build-base gcc autoconf automake zlib-dev libpng-dev nasm bash vips-dev
 ARG NODE_ENV=development
 ENV NODE_ENV=${NODE_ENV}
-WORKDIR /opt/
-COPY ./package.json ./yarn.lock ./
+RUN addgroup -g 1001 strapi && adduser -u 1001 -G strapi -s /bin/sh -D strapi
+
+WORKDIR /opt/{%- if packageManager == "yarn" %}
+COPY package.json yarn.lock ./
+{%- else %}
+COPY package.json package-lock.json ./
+{% endif %}
 ENV PATH /opt/node_modules/.bin:$PATH
-RUN yarn config set network-timeout 600000 -g && yarn install
+RUN chown -R strapi:strapi /opt/
+USER strapi{%- if packageManager == "yarn" %}
+COPY package.json yarn.lock ./
+RUN yarn config set network-timeout 600000 -g && yarn install 
+{%- else %}
+COPY package.json package-lock.json ./
+RUN npm config set network-timeout 600000 -g && npm install
+{%- endif %}
+
 WORKDIR /opt/app
-COPY ./ .
-RUN yarn build
+COPY . .
+{%- if packageManager == "yarn" %}
+RUN ["yarn", "build"]
+{%- else %}
+RUN ["npm", "run", "build"]
+{%- endif %}
 EXPOSE 1337
+{%- if packageManager == "yarn" %}
 CMD ["yarn", "develop"]
 {%- else %}
-FROM node:16-alpine
-# Installing libvips-dev for sharp Compatability
-RUN apk update && apk add --no-cache build-base gcc autoconf automake zlib-dev libpng-dev nasm bash vips-dev
-ARG NODE_ENV=development
-ENV NODE_ENV=${NODE_ENV}
-WORKDIR /opt/
-COPY ./package.json ./package-lock.json ./
-ENV PATH /opt/node_modules/.bin:$PATH
-RUN npm install
-WORKDIR /opt/app
-COPY ./ .
-RUN npm run build
-EXPOSE 1337
 CMD ["npm", "run", "develop"]
-{% endif %}
+{% endif %}