From 413448037cfe33e013ddc96c12b9e0a352e6090a Mon Sep 17 00:00:00 2001 From: Roger Hoem-Martinsen Date: Wed, 15 Jul 2026 11:23:15 +0200 Subject: [PATCH] fix(docker): drop bundled npm from runtime image to clear base-image CVEs The runner stage ships the npm CLI bundled in node:22-alpine, whose vendored dependencies carry known vulnerabilities that trivy flags on the published postgresql-latest image: usr/local/lib/node_modules/npm/node_modules/... - sigstore 3.1.0 CVE-2026-48815 (HIGH) - picomatch 4.0.3 CVE-2026-33671 (HIGH) - @sigstore/core 2.0.0 CVE-2026-48758 - brace-expansion 2.0.2 CVE-2026-33750 - ip-address 10.1.0 CVE-2026-42338 - tar 7.5.11 CVE-2026-53655 npm is only a build-time bootstrap for pnpm; it is not needed at runtime. Install pnpm with it, then remove npm in the same layer so none of these vendored packages are present in the final image, and run the container via pnpm instead of npm. pnpm (and corepack) remain and were never flagged. The curl/libcurl/c-ares HIGH findings are resolved by rebuilding alone, since Alpine 3.24 already serves curl 8.21.0-r0 / c-ares 1.34.8-r0 (the published image is simply stale). Co-Authored-By: Claude Opus 4.8 (1M context) --- Dockerfile | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index d9e967b26..c71b5435c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -44,9 +44,13 @@ ENV NODE_OPTIONS=$NODE_OPTIONS RUN addgroup --system --gid 1001 nodejs RUN adduser --system --uid 1001 nextjs +# Bootstrap pnpm with the bundled npm, then remove npm in the same layer so the +# vulnerable packages vendored inside the npm CLI are not shipped in the final +# image. pnpm is the only package manager needed at build and runtime. RUN set -x \ && apk add --no-cache curl libc6-compat \ - && npm install -g pnpm + && npm install -g pnpm \ + && rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx RUN echo {} > package.json @@ -76,4 +80,4 @@ EXPOSE 3000 ENV HOSTNAME=0.0.0.0 ENV PORT=3000 -CMD ["npm", "run", "start-docker"] +CMD ["pnpm", "run", "start-docker"]