Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: updated docker base image to node:20-alpine3.21 #733

Merged
merged 1 commit into from
Dec 10, 2024
Merged

fix: updated docker base image to node:20-alpine3.21 #733

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 4 additions & 7 deletions apps/webapp/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
# run directly from the repo root directory
# docker build -f ./apps/webapp/Dockerfile .
FROM node:20-alpine AS base
FROM node:20-alpine3.21 AS base
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

LGTM! Base image update and OpenSSL addition.

The changes appropriately address the OpenSSL dependency issue by:

  1. Updating to node:20-alpine3.21
  2. Adding OpenSSL package in all stages

Consider pinning package versions for better reproducibility:

-RUN apk add --no-cache libc6-compat openssl
+RUN apk add --no-cache libc6-compat=1.2.4-r2 openssl=3.1.4-r2

Also applies to: 7-7, 26-26

# =======================================================================
# Turbo: Prepare a standalone workspace for docker
FROM base AS builder
RUN apk add --no-cache libc6-compat
RUN apk add --no-cache libc6-compat openssl
RUN apk update

# Set pnpm
Expand All @@ -23,7 +23,7 @@ RUN ls -la ./out/full/apps/webapp
# =======================================================================
# Install Deps and build project using PNPM
FROM base AS installer
RUN apk add --no-cache libc6-compat
RUN apk add --no-cache libc6-compat openssl
RUN apk update
# Set pnpm
ENV PNPM_HOME="/pnpm"
Expand All @@ -47,8 +47,6 @@ RUN corepack enable

WORKDIR /app

RUN ls -la

# First install the dependencies (as they change less often)
COPY .gitignore .gitignore
COPY --from=builder /app/out/json/ .
Expand All @@ -63,5 +61,4 @@ RUN pnpm install --shamefully-hoist
COPY --from=builder ./app/out/full/ .
RUN pnpm run build

CMD cd /app/apps/webapp/ && pnpm run start

CMD cd /app/apps/webapp/ && pnpm run start
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

Improve CMD instruction format.

Use JSON array notation for CMD as recommended by Docker best practices:

-CMD cd /app/apps/webapp/ && pnpm run start
+CMD ["sh", "-c", "cd /app/apps/webapp/ && pnpm run start"]
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
CMD cd /app/apps/webapp/ && pnpm run start
CMD ["sh", "-c", "cd /app/apps/webapp/ && pnpm run start"]
🧰 Tools
🪛 Hadolint (2.12.0)

[warning] 64-64: Use arguments JSON notation for CMD and ENTRYPOINT arguments

(DL3025)

4 changes: 2 additions & 2 deletions apps/webapp/Dockerfile.dev
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
# run directly from the repo root directory
# docker build -f ./apps/webapp/Dockerfile.dev .
FROM node:20-alpine AS base
FROM node:20-alpine3.21 AS base
# =======================================================================
FROM base AS builder
RUN apk add --no-cache libc6-compat
RUN apk add --no-cache libc6-compat openssl
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

Consider Pinning Package Versions in apk add

For consistent and reproducible builds, consider pinning the versions of the installed packages.

Example:

-RUN apk add --no-cache libc6-compat openssl
+RUN apk add --no-cache \
+  libc6-compat=1.2.3-r0 \
+  openssl=1.1.1k-r0

Ensure the versions match the required dependencies for your application.

Committable suggestion skipped: line range outside the PR's diff.

🧰 Tools
🪛 Hadolint (2.12.0)

[warning] 6-6: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version>

(DL3018)

RUN apk update

# Set pnpm
Expand Down
80 changes: 38 additions & 42 deletions apps/webapp/Dockerfile.slim
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,61 +1,57 @@
FROM node:20-alpine AS base
ENV PNPM_HOME="/pnpm"
ENV PATH="$PNPM_HOME:$PATH"
RUN apk add --no-cache libc6-compat && \
corepack enable
# Alpine image
FROM node:20-alpine3.21 AS alpine
RUN apk update
RUN apk add --no-cache libc6-compat openssl

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

Consider Pinning Package Versions in apk add

Pinning specific package versions ensures reproducibility and consistency across builds. This helps prevent unexpected behavior due to upstream changes.

Example:

 RUN apk update && apk add --no-cache \
-  libc6-compat openssl
+  libc6-compat=1.2.3-r0 openssl=1.1.1k-r0

Replace 1.2.3-r0 and 1.1.1k-r0 with the desired versions based on your requirements.

Committable suggestion skipped: line range outside the PR's diff.

🧰 Tools
🪛 Hadolint (2.12.0)

[warning] 4-4: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version>

(DL3018)

[info] 4-4: Multiple consecutive RUN instructions. Consider consolidation.

(DL3059)

Comment on lines +2 to +4
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

Consolidate RUN Instructions to Optimize Image Build

Combining consecutive RUN instructions reduces the number of layers in the Docker image, leading to a smaller and more efficient build.

Apply this diff to consolidate the commands:

 FROM node:20-alpine3.21 AS alpine
-RUN apk update
-RUN apk add --no-cache libc6-compat openssl
+RUN apk update && apk add --no-cache libc6-compat openssl
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
FROM node:20-alpine3.21 AS alpine
RUN apk update
RUN apk add --no-cache libc6-compat openssl
FROM node:20-alpine3.21 AS alpine
RUN apk update && apk add --no-cache libc6-compat openssl
🧰 Tools
🪛 Hadolint (2.12.0)

[warning] 4-4: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version>

(DL3018)

[info] 4-4: Multiple consecutive RUN instructions. Consider consolidation.

(DL3059)

WORKDIR /app
# Setup pnpm and turbo on the alpine base
FROM alpine as base
RUN npm install pnpm turbo --global
RUN pnpm config set store-dir ~/.pnpm-store
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

Pin Versions When Installing Global NPM Packages

To ensure consistent builds and avoid potential issues due to updated package versions, consider pinning the versions of pnpm and turbo.

Example:

-RUN npm install pnpm turbo --global
+RUN npm install [email protected] [email protected] --global

Ensure that 7.32.0 and 1.13.4 are replaced with the specific versions you intend to use.

Committable suggestion skipped: line range outside the PR's diff.

🧰 Tools
🪛 Hadolint (2.12.0)

[warning] 8-8: Pin versions in npm. Instead of npm install <package> use npm install <package>@<version>

(DL3016)


Comment on lines +8 to +9
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

Consolidate RUN Instructions to Optimize Image Build

Similarly, combining these RUN instructions reduces image layers and improves efficiency.

Apply this diff:

-RUN npm install pnpm turbo --global
-RUN pnpm config set store-dir ~/.pnpm-store
+RUN npm install pnpm turbo --global && pnpm config set store-dir ~/.pnpm-store
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
RUN npm install pnpm turbo --global
RUN pnpm config set store-dir ~/.pnpm-store
RUN npm install pnpm turbo --global && pnpm config set store-dir ~/.pnpm-store
🧰 Tools
🪛 Hadolint (2.12.0)

[warning] 8-8: Pin versions in npm. Instead of npm install <package> use npm install <package>@<version>

(DL3016)

[info] 9-9: Multiple consecutive RUN instructions. Consider consolidation.

(DL3059)

# Install Turbo
RUN pnpm add -g [email protected]
# Prune projects
FROM base AS pruner
ARG PROJECT

# Copy necessary files for turbo prune
WORKDIR /app
COPY . .

# Prune the workspace
RUN turbo prune --scope=webapp --docker

# Installer stage
FROM base AS installer
# Build the project
FROM base AS builder
ARG PROJECT

WORKDIR /app

# Copy pruned files
COPY --from=base /app/out/json/ .
COPY --from=base /app/out/pnpm-lock.yaml ./pnpm-lock.yaml
COPY --from=base /app/out/full/ .
# Copy lockfile and package.json's of isolated subworkspace
COPY --from=pruner /app/out/pnpm-lock.yaml ./pnpm-lock.yaml
COPY --from=pruner /app/out/pnpm-workspace.yaml ./pnpm-workspace.yaml
COPY --from=pruner /app/out/json/ .

# Install dependencies
RUN pnpm install --shamefully-hoist
# First install the dependencies (as they change less often)
RUN --mount=type=cache,id=pnpm,target=~/.pnpm-store pnpm install --frozen-lockfile

# Build shared package first
RUN cd packages/shared && pnpm run build
# Copy source code of isolated subworkspace
COPY --from=pruner /app/out/full/ .

# Build the webapp
RUN pnpm run build --filter=webapp...
RUN turbo build --filter=webapp
RUN --mount=type=cache,id=pnpm,target=~/.pnpm-store pnpm prune --prod --no-optional
RUN rm -rf ./**/*/src

# Runner stage
FROM node:20-alpine AS runner
WORKDIR /app
# Final image
FROM alpine AS runner
ARG PROJECT

# Don't run production as root
RUN addgroup --system --gid 1001 nodejs
RUN adduser --system --uid 1001 nextjs

# Copy necessary files
COPY --from=installer /app/apps/webapp/.next/standalone ./
COPY --from=installer /app/apps/webapp/.next/static ./apps/webapp/.next/static
COPY --from=installer /app/apps/webapp/public ./apps/webapp/public
RUN adduser --system --uid 1001 nodejs
USER nodejs
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

Consolidate RUN Instructions for User Creation

Combining these RUN instructions reduces image layers and streamlines the user setup process.

Apply this diff:

-RUN addgroup --system --gid 1001 nodejs
-RUN adduser --system --uid 1001 nodejs
+RUN addgroup --system --gid 1001 nodejs && \
+    adduser --system --uid 1001 nodejs

Committable suggestion skipped: line range outside the PR's diff.

🧰 Tools
🪛 Hadolint (2.12.0)

[info] 45-45: Multiple consecutive RUN instructions. Consider consolidation.

(DL3059)


# Copy package.json files
COPY --from=installer /app/apps/webapp/package.json ./package.json

# Install only production dependencies

USER nextjs
WORKDIR /app
COPY --from=builder --chown=nodejs:nodejs /app .
WORKDIR /app/apps/webapp

ENV NODE_ENV=production
ARG PORT=8080
ENV PORT=8090

ENV NODE_ENV=production
EXPOSE 8090

Comment on lines +52 to 55
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Ensure Consistent Port Configuration

There is a mismatch between the ARG PORT=8080, ENV PORT=8090, and the port exposed using EXPOSE 8090. This could lead to confusion or misconfiguration when running the container.

Consider aligning the port configurations:

-ARG PORT=8080
-ENV PORT=8090
-ENV NODE_ENV=production
-EXPOSE 8090
+ARG PORT=8080
+ENV PORT=$PORT
+ENV NODE_ENV=production
+EXPOSE $PORT

This change ensures that the port can be configured externally and remains consistent throughout the container setup.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
ARG PORT=8080
ENV PORT=8090
ENV NODE_ENV=production
EXPOSE 8090
ARG PORT=8080
ENV PORT=$PORT
ENV NODE_ENV=production
EXPOSE $PORT

CMD ["node", "server.js"]
CMD node dist/main
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

Use JSON Array Syntax for CMD Instruction

Using JSON array syntax ensures that the command and its arguments are passed correctly without invoking a shell, which can prevent potential issues with argument parsing.

Apply this diff:

-CMD node dist/main
+CMD ["node", "dist/main"]
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
CMD node dist/main
CMD ["node", "dist/main"]
🧰 Tools
🪛 Hadolint (2.12.0)

[warning] 57-57: Use arguments JSON notation for CMD and ENTRYPOINT arguments

(DL3025)

2 changes: 1 addition & 1 deletion apps/webapp/src/app/(Dashboard)/api-keys/page.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,7 +177,7 @@ export default function Page() {
>
<PlusCircle className="h-3.5 w-3.5" />
<span className="sr-only sm:not-sr-only sm:whitespace-nowrap">
Create New Api Key
Create API key
</span>
</Button>
</DialogTrigger>
Expand Down
64 changes: 5 additions & 59 deletions docker-compose.dev.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,7 +100,7 @@ services:
WRIKE_TICKETING_CLOUD_CLIENT_SECRET: ${WRIKE_TICKETING_CLOUD_CLIENT_SECRET}
ASANA_TICKETING_CLOUD_CLIENT_ID: ${ASANA_TICKETING_CLOUD_CLIENT_ID}
ASANA_TICKETING_CLOUD_CLIENT_SECRET: ${ASANA_TICKETING_CLOUD_CLIENT_SECRET}
PENNYLANE_ACCOUNTING_CLOUD_CLIENT_ID: ${PENNYLANE_ACCOUNTING_CLOUD_CLIENT_ID}
PENNYLANE_ACCOUNTING_CLOUD_CLIENT_ID: ${PENNYLANE_ACCOUNTING_CLOUD_CcLIENT_ID}
PENNYLANE_ACCOUNTING_CLOUD_CLIENT_SECRET: ${PENNYLANE_ACCOUNTING_CLOUD_CLIENT_SECRET}
FRESHBOOKS_ACCOUNTING_CLOUD_CLIENT_ID: ${FRESHBOOKS_ACCOUNTING_CLOUD_CLIENT_ID}
FRESHBOOKS_ACCOUNTING_CLOUD_CLIENT_SECRET: ${FRESHBOOKS_ACCOUNTING_CLOUD_CLIENT_SECRET}
Expand Down Expand Up @@ -170,28 +170,9 @@ services:
PH_TELEMETRY: ${PH_TELEMETRY}
SALESFORCE_CRM_CLOUD_CLIENT_ID: ${SALESFORCE_CRM_CLOUD_CLIENT_ID}
SALESFORCE_CRM_CLOUD_CLIENT_SECRET: ${SALESFORCE_CRM_CLOUD_CLIENT_SECRET}
OPENAI_API_KEY: ${OPENAI_API_KEY}
JINA_API_KEY: ${JINA_API_KEY}
COHERE_API_KEY: ${COHERE_API_KEY}
AWS_S3_REGION: ${AWS_S3_REGION}
AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID}
AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY}
UNSTRUCTURED_API_KEY: ${UNSTRUCTURED_API_KEY}
UNSTRUCTURED_API_URL: ${UNSTRUCTURED_API_URL}
PINECONE_API_KEY: ${PINECONE_API_KEY}
PINECONE_INDEX_NAME: ${PINECONE_INDEX_NAME}
QDRANT_BASE_URL: ${QDRANT_BASE_URL}
QDRANT_API_KEY: ${QDRANT_API_KEY}
QDRANT_COLLECTION_NAME: ${QDRANT_COLLECTION_NAME}
CHROMADB_URL: ${CHROMADB_URL}
CHROMADB_COLLECTION_NAME: ${CHROMADB_COLLECTION_NAME}
WEAVIATE_URL: ${WEAVIATE_URL}
WEAVIATE_API_KEY: ${WEAVIATE_API_KEY}
WEAVIATE_CLASS_NAME: ${WEAVIATE_CLASS_NAME}
TURBOPUFFER_API_KEY: ${TURBOPUFFER_API_KEY}
MILVUS_ADDRESS: ${MILVUS_ADDRESS}
MILVUS_COLLECTION_NAME: ${MILVUS_COLLECTION_NAME}

restart: unless-stopped
ports:
- 3000:3000
Expand All @@ -203,7 +184,7 @@ services:
volumes:
- .:/app
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:3000/"]
test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
interval: 10s
timeout: 5s
retries: 1000 # Try launching the API service as long as possible. Required for other services to start
Expand Down Expand Up @@ -251,24 +232,9 @@ services:
- backend
- frontend

magic-link-frontend:
build:
dockerfile: ./apps/magic-link/Dockerfile.dev
context: ./
args:
VITE_BACKEND_DOMAIN: http://localhost:3000
VITE_WEBAPP_DOMAIN: http://localhost
restart: always
ports:
- 81:5173
depends_on:
api:
condition: service_healthy
networks:
- backend
- frontend
volumes:
- .:/app
# # # # # # # # # #
# Developer tools #
# # # # # # # # # #

# pgadmin:
# image: dpage/pgadmin4
Expand Down Expand Up @@ -313,29 +279,9 @@ services:
# volumes:
# - ./docs/:/app

minio:
image: minio/minio
ports:
- "9000:9000"
- "9001:9001"
volumes:
- minio_storage:/data
environment:
MINIO_ROOT_USER: myaccesskey13
MINIO_ROOT_PASSWORD: mysecretkey12
command: server --console-address ":9001" /data
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
interval: 30s
timeout: 20s
retries: 3
networks:
- backend

volumes:
local_pgdata:
pgadmin-data:
minio_storage:

networks:
frontend:
Expand Down
17 changes: 0 additions & 17 deletions docker-compose.source.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,23 +247,6 @@ services:
networks:
- backend
- frontend

magic-link-frontend:
build:
dockerfile: ./apps/magic-link/Dockerfile
context: ./
args:
VITE_BACKEND_DOMAIN: ${NEXT_PUBLIC_BACKEND_DOMAIN}
VITE_WEBAPP_DOMAIN: ${NEXT_PUBLIC_WEBAPP_DOMAIN}
restart: always
ports:
- 81:80
#depends_on:
#api:
#condition: service_healthy
networks:
- backend
- frontend

networks:
frontend:
Expand Down
35 changes: 0 additions & 35 deletions docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -217,19 +217,6 @@ services:
timeout: 5s
retries: 5
start_period: 10s


magic-link-frontend:
image: panora.docker.scarf.sh/panoradotdev/frontend-magic-links:selfhosted
restart: always
ports:
- 81:80
depends_on:
postgres:
condition: service_healthy
networks:
- backend
- frontend

webapp-next:
image: panora.docker.scarf.sh/panoradotdev/frontend-webapp:selfhosted
Expand All @@ -251,28 +238,6 @@ services:
networks:
- backend
- frontend

minio:
image: minio/minio
ports:
- "9000:9000"
- "9001:9001"
volumes:
- minio_storage:/data
environment:
MINIO_ROOT_USER: myaccesskey13
MINIO_ROOT_PASSWORD: mysecretkey12
command: server --console-address ":9001" /data
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
interval: 30s
timeout: 20s
retries: 3
networks:
- backend

volumes:
minio_storage:

networks:
frontend:
Expand Down
8 changes: 4 additions & 4 deletions packages/api/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
# run directly from the repo root directory
# docker build -f ./packages/api/Dockerfile .
FROM node:20-alpine AS base
FROM node:20-alpine3.21 AS base
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

LGTM! Consistent base image update and package additions.

The changes appropriately mirror the webapp Dockerfile changes and include OpenSSL in all stages, including the runner stage.

Consider pinning package versions for better reproducibility:

-RUN apk add --no-cache libc6-compat openssl
+RUN apk add --no-cache libc6-compat=1.2.4-r2 openssl=3.1.4-r2

# For runner stage
-RUN apk add --no-cache libc6-compat netcat-openbsd curl openssl
+RUN apk add --no-cache libc6-compat=1.2.4-r2 netcat-openbsd=1.130-r4 curl=8.5.0-r0 openssl=3.1.4-r2

Also applies to: 6-6, 22-22, 45-45

# =======================================================================
FROM base AS builder
RUN apk add --no-cache libc6-compat
RUN apk add --no-cache libc6-compat openssl
RUN apk update

# Set pnpm
Expand All @@ -19,7 +19,7 @@ RUN turbo prune api --docker
# =======================================================================
# Add lockfile and package.json's of isolated subworkspace
FROM base AS installer
RUN apk add --no-cache libc6-compat
RUN apk add --no-cache libc6-compat openssl
RUN apk update
# Set pnpm
ENV PNPM_HOME="/pnpm"
Expand All @@ -42,7 +42,7 @@ RUN pnpm run build

# ========================================================================
FROM base AS runner
RUN apk add --no-cache libc6-compat netcat-openbsd curl
RUN apk add --no-cache libc6-compat netcat-openbsd curl openssl

WORKDIR /app

Expand Down
4 changes: 2 additions & 2 deletions packages/api/Dockerfile.dev
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
# run directly from the repo root directory
# docker build -f ./packages/api/Dockerfile.dev .
FROM node:20-alpine AS base
FROM node:20-alpine3.21 AS base
# =======================================================================
FROM base AS builder
RUN apk add --no-cache libc6-compat netcat-openbsd curl
RUN apk add --no-cache libc6-compat netcat-openbsd curl openssl
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

Consider Pinning Versions in apk add

Pinning package versions enhances build consistency and reproducibility.

Example:

-RUN apk add --no-cache libc6-compat netcat-openbsd curl openssl
+RUN apk add --no-cache \
+  libc6-compat=1.2.3-r0 \
+  netcat-openbsd=1.130-r0 \
+  curl=7.78.0-r0 \
+  openssl=1.1.1k-r0

Replace the version numbers with the desired versions based on your project's requirements.

Committable suggestion skipped: line range outside the PR's diff.

🧰 Tools
🪛 Hadolint (2.12.0)

[warning] 6-6: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version>

(DL3018)

RUN apk update

# Set pnpm
Expand Down
4 changes: 2 additions & 2 deletions packages/api/Dockerfile.pnpm-build
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,11 +4,11 @@
# 3/ run with: docker run -v $(pwd):/app/ package_builder
################################################

FROM node:20-alpine AS base
FROM node:20-alpine3.21 AS base

# =======================================================================
FROM base AS builder
RUN apk add --no-cache libc6-compat netcat-openbsd curl
RUN apk add --no-cache libc6-compat netcat-openbsd curl openssl
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

Consider pinning package versions for better reproducibility.

While adding openssl addresses the dependency issue, consider pinning specific versions for all packages to ensure consistent builds:

-RUN apk add --no-cache libc6-compat netcat-openbsd curl openssl
+RUN apk add --no-cache \
+    libc6-compat=1.2.4-r2 \
+    netcat-openbsd=1.130-r5 \
+    curl=8.5.0-r0 \
+    openssl=3.1.4-r5

Committable suggestion skipped: line range outside the PR's diff.

🧰 Tools
🪛 Hadolint (2.12.0)

[warning] 11-11: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version>

(DL3018)

RUN apk update

# Set pnpm
Expand Down
Loading
Loading