refactor: enhance Dockerfiles and entrypoint scripts, update dependen…

.dockerignore

@@ -1,2 +1,9 @@
 node_modules
-npm-debug.log
+npm-debug.log
+build/
+*.log
+.env
+.git
+.gitignore
+Dockerfile
+.dockerignore

.talismanrc

@@ -88,4 +88,6 @@ fileignoreconfig:
     checksum: faac1367b4d80e022d4b7a165f9d2ac8bfd428f1a91af849064992ae2b3d6b1f
   - filename: ui/src/components/DestinationStack/Actions/LoadLanguageMapper.tsx
     checksum: 988d93b93768ef0909305590ab0b89456333b9937ec12828edf23163f8640dfc
+  - filename: api/src/services/sitecore.service.ts
+    checksum: ceaed6417b1b6fd2581f547cbc7e871900ecbae5557496b26f025781f323ba82
 version: "1.0"

api/Dockerfile

@@ -1,13 +1,20 @@
-FROM --platform=linux/amd64 node:24.1.0-alpine3.22
+FROM node:24.4.1-alpine
 
 WORKDIR /usr/src/app
 
 COPY package*.json ./
 
-RUN npm install
+RUN npm install \
+    && addgroup -S nodeapp \
+    && adduser -S nodeapp -G nodeapp
 
 COPY . .
 
+# If your app writes to a build or other directory, create and set permissions here
+RUN mkdir -p /usr/src/app/build && chown -R nodeapp:nodeapp /usr/src/app
+
+USER nodeapp
+
 EXPOSE 5001
 
-CMD [ "npm","run", "dev"]
+CMD [ "npm", "run", "dev" ]

api/package.json

@@ -25,7 +25,7 @@
   },
   "homepage": "https://github.com/contentstack/migration-v2.git#readme",
   "dependencies": {
-    "@contentstack/cli": "^1.34.0",
+    "@contentstack/cli": "1.41.0",
     "@contentstack/cli-utilities": "^1.12.0",
     "@contentstack/json-rte-serializer": "^2.0.7",
     "@contentstack/marketplace-sdk": "^1.2.4",

api/src/services/migration.service.ts

@@ -327,20 +327,20 @@ const startTestMigration = async (req: Request): Promise<any> => {
       destinationStackId: project?.current_test_stack_id,
     });
     await taxonomyService?.createTaxonomy({
-      orgId, 
+      orgId,
       projectId,
-      stackId:project?.destination_stack_id,
+      stackId: project?.destination_stack_id,
       current_test_stack_id: project?.current_test_stack_id,
       region,
       userId: user_id,
     });
     await globalFieldServie?.createGlobalField({
       region,
-      user_id, 
-      stackId:project?.destination_stack_id,
+      user_id,
+      stackId: project?.destination_stack_id,
       current_test_stack_id: project?.current_test_stack_id,
     });
-    
+
     switch (cms) {
       case CMS.SITECORE_V8:
       case CMS.SITECORE_V9:
@@ -361,6 +361,9 @@ const startTestMigration = async (req: Request): Promise<any> => {
             projectId,
             project
           );
+          await siteCoreService?.createEnvironment(
+            project?.current_test_stack_id
+          )
           await siteCoreService?.createVersionFile(
             project?.current_test_stack_id
           );
@@ -563,17 +566,17 @@ const startMigration = async (req: Request): Promise<any> => {
       destinationStackId: project?.destination_stack_id,
     });
     await taxonomyService?.createTaxonomy({
-    orgId, 
-    projectId,
-    stackId:project?.destination_stack_id,
-    current_test_stack_id: project?.destination_stack_id,
-    region,
-    userId: user_id,
+      orgId,
+      projectId,
+      stackId: project?.destination_stack_id,
+      current_test_stack_id: project?.destination_stack_id,
+      region,
+      userId: user_id,
     });
     await globalFieldServie?.createGlobalField({
       region,
-      user_id, 
-      stackId:project?.destination_stack_id,
+      user_id,
+      stackId: project?.destination_stack_id,
       current_test_stack_id: project?.destination_stack_id,
     });
     switch (cms) {
@@ -732,7 +735,7 @@ const getAuditData = async (req: Request): Promise<any> => {
         if (!safeEntriesSelectFieldPath.startsWith(auditLogPath)) {
           throw new BadRequestError('Access to this file is not allowed.');
         }
-       
+
         const fileContent = await fsPromises?.readFile(safeEntriesSelectFieldPath, 'utf8');
         try {
           if (typeof fileContent === 'string') {

api/src/services/sitecore.service.ts

@@ -16,6 +16,7 @@ import { getSafePath } from '../utils/sanitize-path.utils.js';
 const append = 'a';
 const baseDirName = MIGRATION_DATA_CONFIG.DATA;
 const {
+  ENVIRONMENTS_DIR_NAME,
   ENTRIES_DIR_NAME,
   LOCALE_DIR_NAME,
   LOCALE_MASTER_LOCALE,
@@ -24,6 +25,7 @@ const {
   ASSETS_DIR_NAME,
   ASSETS_FILE_NAME,
   ASSETS_SCHEMA_FILE,
+  ENVIRONMENTS_FILE_NAME
 } = MIGRATION_DATA_CONFIG;
 
 const idCorrector = ({ id }: any) => {
@@ -159,7 +161,7 @@ const createAssets = async ({
       const blobPath: any = path.join(packagePath, 'blob', 'master');
       const assetsPath = read(blobPath);
       if (assetsPath?.length) {
-        const isIdPresent = assetsPath?.find((ast) =>{
+        const isIdPresent = assetsPath?.find((ast) => {
           return ast?.includes(metaData?.id)
         }
         );
@@ -307,8 +309,7 @@ const createEntry = async ({
     for await (const ctType of contentTypes) {
       const message = getLogMessage(
         srcFunc,
-        `Transforming entries of Content Type ${
-          keyMapper?.[ctType?.contentstackUid] ?? ctType?.contentstackUid
+        `Transforming entries of Content Type ${keyMapper?.[ctType?.contentstackUid] ?? ctType?.contentstackUid
         } has begun.`,
         {}
       );
@@ -407,7 +408,7 @@ const createEntry = async ({
           );
           const mapperCt: string =
             keyMapper?.[ctType?.contentstackUid] !== '' &&
-            keyMapper?.[ctType?.contentstackUid] !== undefined
+              keyMapper?.[ctType?.contentstackUid] !== undefined
               ? keyMapper?.[ctType?.contentstackUid]
               : ctType?.contentstackUid;
           const fileMeta = { '1': `${newLocale}.json` };
@@ -422,8 +423,7 @@ const createEntry = async ({
       } else {
         const message = getLogMessage(
           srcFunc,
-          `No entries found for the content type ${
-            keyMapper?.[ctType?.contentstackUid] ?? ctType?.contentstackUid
+          `No entries found for the content type ${keyMapper?.[ctType?.contentstackUid] ?? ctType?.contentstackUid
           }.`,
           {}
         );
@@ -530,9 +530,22 @@ const createVersionFile = async (destinationStackId: string) => {
   );
 };
 
+const createEnvironment = async (destinationStackId: string) => {
+  const baseDir = path.join(baseDirName, destinationStackId);
+  const environmentSave = path.join(baseDir, ENVIRONMENTS_DIR_NAME);
+  const environmentFile = path.join(environmentSave, ENVIRONMENTS_FILE_NAME);
+
+  // Ensure the directory exists
+  await fs.promises.mkdir(environmentSave, { recursive: true });
+
+  // Write an empty environments file (or replace {} with your actual data)
+  await fs.promises.writeFile(environmentFile, JSON.stringify({}), 'utf8');
+}
+
 export const siteCoreService = {
   createEntry,
   createAssets,
   createLocale,
   createVersionFile,
+  createEnvironment
 };

docker-compose.yml

@@ -8,7 +8,10 @@ services:
       - "5001:5001"
     restart: always
     volumes:
+      - ${CMS_DATA_PATH}:${CONTAINER_PATH}
       - shared_data:/app/extracted_files
+    security_opt:
+      - no-new-privileges:true
 
   upload-api:
     container_name: migration-upload-api
@@ -20,6 +23,8 @@ services:
     volumes:
       - ${CMS_DATA_PATH}:${CONTAINER_PATH}
       - shared_data:/app/extracted_files
+    security_opt:
+      - no-new-privileges:true
 
   ui:
     container_name: migration-ui
@@ -28,6 +33,8 @@ services:
     ports:
       - "3000:3000"
     restart: always
+    security_opt:
+      - no-new-privileges:true
 
 volumes:
-  shared_data:
+  shared_data:

ui/.dockerignore

@@ -1,3 +1,9 @@
 node_modules
 npm-debug.log
-build
+Dockerfile
+build/
+*.log
+.git
+.gitignore
+.dockerignore
+.env

ui/Dockerfile

@@ -1,13 +1,21 @@
-FROM --platform=linux/amd64 node:22-alpine
+FROM node:22-alpine
 
 WORKDIR /usr/src/app
 
 COPY package*.json ./
 
-RUN apk update && apk upgrade && npm install
+RUN apk update && apk upgrade \
+    && npm install \
+    && addgroup -S nodeapp \
+    && adduser -S nodeapp -G nodeapp
 
 COPY . .
 
+# Ensure permissions for nodeapp user
+RUN chown -R nodeapp:nodeapp /usr/src/app
+
+USER nodeapp
+
 EXPOSE 3000
 
-CMD [ "npm","run", "start"]
+CMD [ "npm", "run", "start" ]

upload-api/Dockerfile

@@ -1,20 +1,26 @@
-# Use an official Node.js runtime as a base image
-FROM --platform=linux/amd64 node:24.1.0-alpine3.22
+FROM node:24.4.1-alpine
 
-# Set the working directory in the container
 WORKDIR /app
 
-# Copy package.json and package-lock.json to the working directory
 COPY package*.json ./
 
-# Install application dependencies
-RUN npm install
+RUN npm install \
+    && addgroup -S nodeapp \
+    && adduser -S nodeapp -G nodeapp
 
-# Copy the application code to the container
 COPY . .
 
-# Expose the port your app will run on
+RUN mkdir -p /app/build \
+    && mkdir -p /app/extracted_files \
+    && chown -R nodeapp:nodeapp /app
+
+COPY docker-entrypoint.sh /usr/local/bin/
+RUN chmod +x /usr/local/bin/docker-entrypoint.sh
+
+USER nodeapp
+
 EXPOSE 4002
 
-# Define the command to run your application
-CMD ["npm", "run", "start"] 
+ENTRYPOINT ["docker-entrypoint.sh"]
+
+CMD ["npm", "run", "start"]

upload-api/docker-entrypoint.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+set -e
+
+# Fix permissions for extracted_files volume at runtime
+chown -R nodeapp:nodeapp /app/extracted_files
+
+exec "$@"