Skip to content

fix(release): harden v0.9 image bases #341

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jeremi merged 1 commit into from
Jul 10, 2026
+7 −2
Merged

fix(release): harden v0.9 image bases #341

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion release/docker/Dockerfile.registry-notary-openfn-sidecar
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,12 +6,17 @@
# engine is retired, but the historical image and binary name remain stable for
# lab compatibility.

FROM node:22-bookworm-slim@sha256:813a7480f28fdadac1f7f5c824bcdad435b5bc1322a5968bbbdef8d058f9dff4 AS runtime
FROM node:22-bookworm-slim@sha256:53ada149d435c38b14476cb57e4a7da73c15595aba79bd6971b547ceb6d018bf AS runtime

RUN apt-get update \
&& apt-get install -y --no-install-recommends ca-certificates curl \
&& rm -rf /var/lib/apt/lists/*

# The runtime needs Node.js for the bundled mock registry server, but it does
# not install packages. Keep npm and its dependency tree out of the image.
RUN rm -rf /usr/local/lib/node_modules/npm \
&& rm -f /usr/local/bin/npm /usr/local/bin/npx
Comment on lines +17 to +18

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Exclude npm from final image layers

For the release image pushed from this Dockerfile, deleting /usr/local/lib/node_modules/npm in a later RUN step only adds whiteouts over files that already came from the node:22-bookworm-slim base layer. The npm package tree is still present in the distributed image blobs and can be recovered or reported by scanners that inspect all layers, so this does not actually keep npm out of the image as the hardening comment requires. Build the final stage from a base/layer that never contains npm, or copy only the needed Node runtime files into a fresh final stage.

Useful? React with 👍 / 👎.


WORKDIR /opt/openfn
COPY --chmod=0755 dist/image-bin/registry-notary-openfn-sidecar /usr/local/bin/registry-notary-openfn-sidecar
COPY lab/config/openfn/mock-registry-server.mjs ./mock-registry-server.mjs
Expand Down
2 changes: 1 addition & 1 deletion release/docker/Dockerfile.registry-relay
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ RUN mkdir -p \
/workspace/runtime-root/var/log/registry-relay && \
chown -R 65532:65532 /workspace/runtime-root

FROM gcr.io/distroless/cc-debian12:nonroot@sha256:bd2899c12b335c827750ccf2359879eab09c09b206023dcebea408947d54127c AS runtime
FROM gcr.io/distroless/cc-debian12:nonroot@sha256:ce0d66bc0f64aae46e6a03add867b07f42cc7b8799c949c2e898057b7f75a151 AS runtime

COPY --from=runtime-root --chown=65532:65532 /workspace/runtime-root/ /
COPY --chmod=0755 dist/image-bin/registry-relay /usr/local/bin/registry-relay
Expand Down
Loading