Docker hardened images

.dockerignore

@@ -0,0 +1,11 @@
+.git
+.next
+node_modules
+.env*
+.cursor
+.github
+*.log
+npm-debug.log*
+dev.Dockerfile
+.drone.yml
+README.md

.drone.yml

@@ -13,8 +13,18 @@ steps:
       - 'git config --global url."https://github.com/".insteadOf git@github.com:'
       - "git submodule update --recursive"
   - name: build and publish
-    image: plugins/docker
+    image: plugins/docker:21
+    environment:
+      BUILDX_NO_DEFAULT_ATTESTATIONS: "1"
+    depends_on:
+      - submodules
     settings:
+      platform: linux/amd64
+      base_image_registry: dhi.io
+      base_image_username:
+        from_secret: dockerhub_username
+      base_image_password:
+        from_secret: dockerhub_password
       registry: registry.dev.kern.ai
       username:
         from_secret: docker_username
@@ -75,8 +85,18 @@ steps:
       - 'git config --global url."https://github.com/".insteadOf git@github.com:'
       - "git submodule update --recursive"
   - name: build and publish
-    image: plugins/docker
+    image: plugins/docker:21
+    environment:
+      BUILDX_NO_DEFAULT_ATTESTATIONS: "1"
+    depends_on:
+      - submodules
     settings:
+      platform: linux/arm64
+      base_image_registry: dhi.io
+      base_image_username:
+        from_secret: dockerhub_username
+      base_image_password:
+        from_secret: dockerhub_password
       registry: registry.dev.kern.ai
       username:
         from_secret: docker_username
@@ -110,13 +130,23 @@ steps:
       - 'git config --global url."https://github.com/".insteadOf git@github.com:'
       - "git submodule update --recursive"
   - name: build and publish
-    image: plugins/docker
+    image: plugins/docker:21
+    environment:
+      BUILDX_NO_DEFAULT_ATTESTATIONS: "1"
+    depends_on:
+      - submodules
     settings:
+      base_image_registry: dhi.io
+      base_image_username:
+        from_secret: dockerhub_username
+      base_image_password:
+        from_secret: dockerhub_password
       username:
         from_secret: dockerhub_username
       password:
         from_secret: dockerhub_password
       repo: "kernai/${DRONE_REPO_NAME}"
+      platform: linux/amd64
       tag: "${DRONE_TAG}-drone-amd64"
 
 trigger:
@@ -139,13 +169,23 @@ steps:
       - 'git config --global url."https://github.com/".insteadOf git@github.com:'
       - "git submodule update --recursive"
   - name: build and publish
-    image: plugins/docker
+    image: plugins/docker:21
+    environment:
+      BUILDX_NO_DEFAULT_ATTESTATIONS: "1"
+    depends_on:
+      - submodules
     settings:
+      base_image_registry: dhi.io
+      base_image_username:
+        from_secret: dockerhub_username
+      base_image_password:
+        from_secret: dockerhub_password
       username:
         from_secret: dockerhub_username
       password:
         from_secret: dockerhub_password
       repo: "kernai/${DRONE_REPO_NAME}"
+      platform: linux/arm64
       tag: "${DRONE_TAG}-drone-arm64"
 
 trigger:
@@ -173,4 +213,4 @@ depends_on:
 
 trigger:
   event:
-    - tag
+    - tag

Dockerfile

@@ -1,9 +1,39 @@
-FROM node:18-alpine AS build
+ARG DHI_NODE_BUILD=dhi.io/node:20-debian12-dev
+ARG DHI_NODE_RUNTIME=dhi.io/node:20-debian12
+
+FROM ${DHI_NODE_BUILD} AS builder
 
 WORKDIR /app
-COPY package*.json /app/
-RUN npm install
-COPY . /app
+
+COPY package*.json ./
+ENV NEXT_TELEMETRY_DISABLED=1
+RUN npm install && npm cache clean --force
+
+COPY pages ./pages
+COPY pkg ./pkg
+COPY util ./util
+COPY styles ./styles
+COPY i18n ./i18n
+COPY public ./public
+COPY submodules ./submodules
+COPY next.config.js .
+COPY tsconfig.json .
+COPY postcss.config.js .
+COPY tailwind.config.js .
+
 RUN npm run build
 
-ENTRYPOINT ["/usr/local/bin/npm", "run", "start"]
+FROM ${DHI_NODE_RUNTIME}
+
+WORKDIR /app
+
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+
+COPY --from=builder --chown=1000:1000 /app/.next/standalone ./
+COPY --from=builder --chown=1000:1000 /app/public ./public
+COPY --from=builder --chown=1000:1000 /app/.next/static ./.next/static
+
+USER node
+
+ENTRYPOINT ["node", "server.js"]

dev.Dockerfile

@@ -1,9 +1,13 @@
-FROM node:18-alpine
+ARG PARENT_IMAGE=dhi.io/node:20-debian12-dev
+
+FROM ${PARENT_IMAGE}
 
 WORKDIR /app
 
 VOLUME ["/app"]
 
+USER root
+
 COPY package*.json /app/
 
 ENV NEXT_TELEMETRY_DISABLED=1
@@ -12,4 +16,4 @@ ENV WATCHPACK_POLLING=true
 
 RUN npm install --include=dev
 
-ENTRYPOINT ["/usr/local/bin/npm", "run", "dev"]
+ENTRYPOINT ["/usr/local/bin/npm", "run", "dev"]

next.config.js

@@ -1,5 +1,6 @@
 /** @type {import('next').NextConfig} */
 const nextConfig = {
+  output: 'standalone',
   reactStrictMode: true,
   swcMinify: true,
   env: {