Austin McKinley
bf71c329c6
The June 18 2026 Node.js security releases fix several HIGH/MEDIUM CVEs on the 24.x line, with 24.17.0 as the first patched release. The service images were pinned to 24.15, below that line. Bump to 24.18-alpine3.23 (latest 24.x) to pick up the fixes, including: - CVE-2026-48618 (HIGH) TLS wildcard-depth auth bypass - CVE-2026-48933 (HIGH) WebCrypto AES integer overflow crash - CVE-2026-48928/48930/48934 (MEDIUM) TLS/SNI identity verification bypasses - CVE-2026-48619 (MEDIUM) unbounded HTTP/2 memory growth via ORIGIN frames Advisory: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
85 lines
1.8 KiB
Docker
85 lines
1.8 KiB
Docker
FROM golang:1.26-bookworm AS build-env
|
|
|
|
WORKDIR /usr/src/social-app
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
|
|
# Node
|
|
ENV NODE_VERSION=24.18.0
|
|
ENV NVM_DIR=/usr/share/nvm
|
|
|
|
# Go
|
|
ENV GODEBUG="netdns=go"
|
|
ENV GOOS="linux"
|
|
ARG TARGETARCH
|
|
ENV GOARCH=${TARGETARCH:-amd64}
|
|
ENV CGO_ENABLED=1
|
|
ENV GOEXPERIMENT="loopvar"
|
|
|
|
# CI environment for pnpm
|
|
ENV CI=true
|
|
|
|
COPY . .
|
|
|
|
#
|
|
# Generate the JavaScript webpack. NOTE: this will change
|
|
#
|
|
RUN mkdir --parents $NVM_DIR && \
|
|
wget \
|
|
--output-document=/tmp/nvm-install.sh \
|
|
https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh && \
|
|
bash /tmp/nvm-install.sh
|
|
|
|
RUN \. "$NVM_DIR/nvm.sh" && \
|
|
nvm install $NODE_VERSION && \
|
|
nvm use $NODE_VERSION && \
|
|
npm install --global pnpm@11.9.0 && \
|
|
pnpm install --frozen-lockfile && \
|
|
cd bskyembed && pnpm install --frozen-lockfile && cd .. && \
|
|
pnpm intl:build && \
|
|
pnpm build-embed
|
|
|
|
# DEBUG
|
|
RUN find ./bskyweb/embedr-static && find ./bskyweb/embedr-templates && find ./bskyembed/dist
|
|
|
|
# hack around issue with empty directory and go:embed
|
|
RUN touch bskyweb/static/js/empty.txt
|
|
RUN touch bskyweb/static/css/empty.txt
|
|
RUN touch bskyweb/static/media/empty.txt
|
|
|
|
#
|
|
# Generate the embedr Go binary.
|
|
#
|
|
RUN cd bskyweb/ && \
|
|
go mod download && \
|
|
go mod verify
|
|
|
|
RUN cd bskyweb/ && \
|
|
go build \
|
|
-v \
|
|
-trimpath \
|
|
-tags timetzdata \
|
|
-o /embedr \
|
|
./cmd/embedr
|
|
|
|
FROM debian:bookworm-slim
|
|
|
|
ENV GODEBUG=netdns=go
|
|
ENV TZ=Etc/UTC
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
|
|
RUN apt-get update && apt-get install --yes \
|
|
dumb-init \
|
|
ca-certificates
|
|
|
|
ENTRYPOINT ["dumb-init", "--"]
|
|
|
|
WORKDIR /embedr
|
|
COPY --from=build-env /embedr /usr/bin/embedr
|
|
|
|
CMD ["/usr/bin/embedr"]
|
|
|
|
LABEL org.opencontainers.image.source=https://github.com/bluesky-social/social-app
|
|
LABEL org.opencontainers.image.description="embed.bsky.app Web App"
|
|
LABEL org.opencontainers.image.licenses=MIT
|