Skip to content

fix: Use node image instead of curl download #256

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
MCarlomagno wants to merge 6 commits into from
Closed

fix: Use node image instead of curl download #256

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
cb86a78
fix: Use node image instead of curl download
MCarlomagno Jun 3, 2025
08c143c
fix: Un-root user
MCarlomagno Jun 4, 2025
b1dd827
fix: Use nobody as the owner of plugins folder
MCarlomagno Jun 4, 2025
7057798
fix: Use production node env in prod dockerfile
MCarlomagno Jun 4, 2025
5b8c8df
fix: Remove unused stage from Dockerfile
MCarlomagno Jun 5, 2025
6964070
fix: Use nobody as executable owner + avoid pnpm install
MCarlomagno Jun 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 9 additions & 17 deletions Dockerfile.development
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,30 +19,20 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
--mount=type=cache,target=/app/target \
cargo install --root /usr/app --path . --debug --locked

# Setting up build directories
FROM --platform=${BUILDPLATFORM} cgr.dev/chainguard/glibc-dynamic:latest-dev

WORKDIR /app

COPY --from=base --chown=nonroot:nonroot /usr/app/bin/openzeppelin-relayer /app/openzeppelin-relayer
# Node image
FROM cgr.dev/chainguard/node:latest-dev AS node

# Install plugin dependencies
ARG TARGETARCH
ENV NODE_VERSION=v20.19.2
WORKDIR /app

# Install Node.js
# Install pnpm and ts-node
USER root
RUN apk add --no-cache curl && \
curl -fsSL https://nodejs.org/download/release/${NODE_VERSION}/node-${NODE_VERSION}-linux-${TARGETARCH}.tar.xz \
| tar -xJ --strip-components=1 -C /usr/local
ENV PATH="/usr/local/bin:$PATH"
RUN npm install -g ts-node typescript

# Install pnpm and ts-node
RUN npm install -g pnpm ts-node typescript
COPY --from=base --chown=nobody:nobody /usr/app/bin/openzeppelin-relayer /app/openzeppelin-relayer

# Copy plugins folder and install dependencies
COPY ./plugins /app/plugins
RUN chown -R nonroot:nonroot /app/plugins
COPY --chown=nobody ./plugins /app/plugins
WORKDIR /app/plugins
RUN pnpm install --frozen-lockfile

Expand All @@ -54,5 +44,7 @@ ENV METRICS_PORT=8081

EXPOSE ${APP_PORT}/tcp ${METRICS_PORT}/tcp

USER nobody

# starting up
ENTRYPOINT ["/app/openzeppelin-relayer"]
29 changes: 11 additions & 18 deletions Dockerfile.production
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,31 +14,22 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
--mount=type=cache,target=/app/target \
cargo install --root /usr/app --path . --debug --locked

# Setting up build directories
FROM --platform=${BUILDPLATFORM} cgr.dev/chainguard/glibc-dynamic:latest
# Node image
FROM cgr.dev/chainguard/node:latest AS node
ENV NODE_ENV=production

Copy link
Copy Markdown
Contributor

@LuisUrrutia LuisUrrutia Jun 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could also add:

ENV NODE_ENV=production

WORKDIR /app
COPY --from=base --chown=nonroot:nonroot /usr/app/bin/openzeppelin-relayer /app/openzeppelin-relayer
COPY --from=base /usr/lib/libssl.so.3 /usr/lib/libssl.so.3
COPY --from=base /usr/lib/libcrypto.so.3 /usr/lib/libcrypto.so.3

# Install plugin dependencies
ARG TARGETARCH
ENV NODE_VERSION=v20.19.2

# Install Node.js
# Install pnpm and ts-node
USER root
RUN apk add --no-cache curl && \
curl -fsSL https://nodejs.org/download/release/${NODE_VERSION}/node-${NODE_VERSION}-linux-${TARGETARCH}.tar.xz \
| tar -xJ --strip-components=1 -C /usr/local
ENV PATH="/usr/local/bin:$PATH"
RUN npm install -g ts-node typescript

# Install pnpm and ts-node
RUN npm install -g pnpm ts-node typescript
COPY --from=base --chown=nobody:nobody /usr/app/bin/openzeppelin-relayer /app/openzeppelin-relayer
COPY --from=base /usr/lib/libssl.so.3 /usr/lib/libssl.so.3
COPY --from=base /usr/lib/libcrypto.so.3 /usr/lib/libcrypto.so.3

# Copy plugins folder and install dependencies
COPY ./plugins /app/plugins
RUN chown -R nonroot:nonroot /app/plugins
COPY --chown=nobody ./plugins /app/plugins
WORKDIR /app/plugins
RUN pnpm install --frozen-lockfile

Expand All @@ -51,5 +42,7 @@ ENV METRICS_PORT=8081

EXPOSE ${APP_PORT}/tcp ${METRICS_PORT}/tcp

USER nobody

# starting up
ENTRYPOINT ["/app/openzeppelin-relayer"]