From 9cfa7a2c40547bd04e257db1f4dd4c4c28cfe01f Mon Sep 17 00:00:00 2001 From: Jeremi Joslin Date: Fri, 10 Jul 2026 23:12:08 +0700 Subject: [PATCH] fix(release): harden v0.9 image bases Signed-off-by: Jeremi Joslin --- release/docker/Dockerfile.registry-notary-openfn-sidecar | 7 ++++++- release/docker/Dockerfile.registry-relay | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/release/docker/Dockerfile.registry-notary-openfn-sidecar b/release/docker/Dockerfile.registry-notary-openfn-sidecar index 5e961bdb..8de50320 100644 --- a/release/docker/Dockerfile.registry-notary-openfn-sidecar +++ b/release/docker/Dockerfile.registry-notary-openfn-sidecar @@ -6,12 +6,17 @@ # engine is retired, but the historical image and binary name remain stable for # lab compatibility. -FROM node:22-bookworm-slim@sha256:813a7480f28fdadac1f7f5c824bcdad435b5bc1322a5968bbbdef8d058f9dff4 AS runtime +FROM node:22-bookworm-slim@sha256:53ada149d435c38b14476cb57e4a7da73c15595aba79bd6971b547ceb6d018bf AS runtime RUN apt-get update \ && apt-get install -y --no-install-recommends ca-certificates curl \ && rm -rf /var/lib/apt/lists/* +# The runtime needs Node.js for the bundled mock registry server, but it does +# not install packages. Keep npm and its dependency tree out of the image. +RUN rm -rf /usr/local/lib/node_modules/npm \ + && rm -f /usr/local/bin/npm /usr/local/bin/npx + WORKDIR /opt/openfn COPY --chmod=0755 dist/image-bin/registry-notary-openfn-sidecar /usr/local/bin/registry-notary-openfn-sidecar COPY lab/config/openfn/mock-registry-server.mjs ./mock-registry-server.mjs diff --git a/release/docker/Dockerfile.registry-relay b/release/docker/Dockerfile.registry-relay index fa882bce..ab5a49d7 100644 --- a/release/docker/Dockerfile.registry-relay +++ b/release/docker/Dockerfile.registry-relay @@ -9,7 +9,7 @@ RUN mkdir -p \ /workspace/runtime-root/var/log/registry-relay && \ chown -R 65532:65532 /workspace/runtime-root -FROM gcr.io/distroless/cc-debian12:nonroot@sha256:bd2899c12b335c827750ccf2359879eab09c09b206023dcebea408947d54127c AS runtime +FROM gcr.io/distroless/cc-debian12:nonroot@sha256:ce0d66bc0f64aae46e6a03add867b07f42cc7b8799c949c2e898057b7f75a151 AS runtime COPY --from=runtime-root --chown=65532:65532 /workspace/runtime-root/ / COPY --chmod=0755 dist/image-bin/registry-relay /usr/local/bin/registry-relay