Austin McKinley
bf71c329c6
The June 18 2026 Node.js security releases fix several HIGH/MEDIUM CVEs on the 24.x line, with 24.17.0 as the first patched release. The service images were pinned to 24.15, below that line. Bump to 24.18-alpine3.23 (latest 24.x) to pick up the fixes, including: - CVE-2026-48618 (HIGH) TLS wildcard-depth auth bypass - CVE-2026-48933 (HIGH) WebCrypto AES integer overflow crash - CVE-2026-48928/48930/48934 (MEDIUM) TLS/SNI identity verification bypasses - CVE-2026-48619 (MEDIUM) unbounded HTTP/2 memory growth via ORIGIN frames Advisory: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
40 lines
1.0 KiB
Docker
40 lines
1.0 KiB
Docker
FROM node:24.18.0-alpine3.23 AS build
|
|
|
|
# Move files into the image and install
|
|
WORKDIR /app
|
|
|
|
COPY ./bskylink/package.json ./
|
|
COPY ./bskylink/yarn.lock ./
|
|
RUN yarn install --frozen-lockfile
|
|
|
|
COPY ./bskylink ./
|
|
|
|
# build then prune dev deps
|
|
RUN yarn build
|
|
RUN yarn install --production --ignore-scripts --prefer-offline
|
|
|
|
# Uses assets from build stage to reduce build size
|
|
FROM node:24.18.0-alpine3.23
|
|
|
|
RUN apk add --update dumb-init
|
|
|
|
# Avoid zombie processes, handle signal forwarding
|
|
ENTRYPOINT ["dumb-init", "--"]
|
|
|
|
WORKDIR /app
|
|
COPY --from=build /app /app
|
|
RUN mkdir /app/data && chown node /app/data
|
|
|
|
VOLUME /app/data
|
|
EXPOSE 3000
|
|
ENV LINK_PORT=3000
|
|
ENV NODE_ENV=production
|
|
|
|
# https://github.com/nodejs/docker-node/blob/master/docs/BestPractices.md#non-root-user
|
|
USER node
|
|
CMD ["node", "--heapsnapshot-signal=SIGUSR2", "--enable-source-maps", "dist/bin.js"]
|
|
|
|
LABEL org.opencontainers.image.source=https://github.com/bluesky-social/social-app
|
|
LABEL org.opencontainers.image.description="Bsky Link Service"
|
|
LABEL org.opencontainers.image.licenses=UNLICENSED
|