|
| 1 | +# Node.js from the official Alpine image instead of Alpine's nodejs package, which |
| 2 | +# lags Node's security releases. Match the major version to what reachability needs |
| 3 | +# and the Alpine release to the python:3-alpine base below. |
| 4 | +FROM node:24-alpine3.24 AS node |
| 5 | + |
1 | 6 | FROM python:3-alpine |
2 | 7 | LABEL org.opencontainers.image.authors="socket.dev" |
3 | 8 |
|
@@ -18,11 +23,24 @@ ARG USE_LOCAL_INSTALL=false |
18 | 23 | # compromised eMudhra intermediates chain to. The base image ships an older |
19 | 24 | # one, and `apk add` does not upgrade installed packages, so upgrade it here. |
20 | 25 | RUN apk update && apk add --no-cache \ |
21 | | - git nodejs npm yarn curl wget \ |
| 26 | + git curl wget \ |
22 | 27 | ruby ruby-dev build-base strace && \ |
23 | 28 | apk upgrade --no-cache ca-certificates && \ |
24 | 29 | [ "$(apk version -t "$(apk list -I ca-certificates | awk '{print $1}' | sed 's/^ca-certificates-//')" 20261020-r0)" != "<" ] |
25 | 30 |
|
| 31 | +# npm, npx and yarn are symlinks in the node image. COPY would dereference them |
| 32 | +# into flat files and break their relative requires, so recreate the links. |
| 33 | +COPY --from=node /usr/local/bin/node /usr/local/bin/node |
| 34 | +COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules |
| 35 | +COPY --from=node /opt /opt |
| 36 | +# Node rejects the compromised eMudhra intermediates from 24.22.1. |
| 37 | +RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm && \ |
| 38 | + ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx && \ |
| 39 | + ln -s ../lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack && \ |
| 40 | + ln -s /opt/yarn-v*/bin/yarn /usr/local/bin/yarn && \ |
| 41 | + ln -s /opt/yarn-v*/bin/yarnpkg /usr/local/bin/yarnpkg && \ |
| 42 | + node -e 'const [a,b,c]=process.versions.node.split(".").map(Number); process.exit(a>24||(a===24&&(b>22||(b===22&&c>=1)))?0:1)' |
| 43 | + |
26 | 44 | # Install Go with version control |
27 | 45 | RUN if [ "$GO_VERSION" = "system" ]; then \ |
28 | 46 | apk add --no-cache go && \ |
@@ -89,10 +107,6 @@ RUN npm install socket -g && \ |
89 | 107 | # Set environment paths |
90 | 108 | ENV PATH="/usr/local/go/bin:/usr/lib/go/bin:/root/.cargo/bin:${PATH}" |
91 | 109 | ENV GOPATH="/go" |
92 | | -# Node only rejects the compromised eMudhra intermediates from 22.23.4 / 24.22.1, |
93 | | -# and Alpine's nodejs package is older. Use the system store, which ca-certificates |
94 | | -# above already fixed. Drop this once Alpine's nodejs includes Node's fix. |
95 | | -ENV NODE_OPTIONS="--use-openssl-ca" |
96 | 110 |
|
97 | 111 | # Install uv (0.13.4+ ships the patched webpki-roots) |
98 | 112 | COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /usr/local/bin/uv |
|