Update Dockerfile https://github.com/firepress-org/ghostfire/issues/601#602
Update Dockerfile https://github.com/firepress-org/ghostfire/issues/601#602pascalandy wants to merge 2 commits intomasterfrom
Conversation
WalkthroughThe Dockerfile for the Ghost application was refactored from a multi-stage build with several custom layers to a streamlined two-stage build. The new process uses an Alpine-based Node.js builder and a runtime stage based on the same image, simplifies dependency management, removes privilege-dropping tools, and sets up a non-root runtime user with a direct Node.js entrypoint. Changes
Sequence Diagram(s)sequenceDiagram
participant Builder as Builder Stage (Alpine Node)
participant Runtime as Runtime Stage (Alpine Node)
participant Ghost as Ghost App
Builder->>Builder: Install build & runtime dependencies
Builder->>Builder: Enable Yarn via Corepack
Builder->>Builder: Install Ghost CLI & Ghost (MySQL)
Builder->>Builder: Run npm audit fix & clean caches
Builder->>Runtime: Copy Ghost installation with ownership
Runtime->>Runtime: Set environment and non-root user
Runtime->>Ghost: Run node current/index.js
Ghost->>Ghost: Serve on port 2368
Runtime->>Runtime: Healthcheck via HTTP 200 on port 2368
📜 Recent review detailsConfiguration used: .coderabbit.yaml 📒 Files selected for processing (1)
🧰 Additional context used🪛 Hadolint (2.12.0)v5/Dockerfile[warning] 44-44: Pin versions in apk add. Instead of (DL3018) [info] 44-44: Double quote to prevent globbing and word splitting. (SC2086) [warning] 79-79: Last USER should not be root (DL3002) ⏰ Context from checks skipped due to timeout of 90000ms (1)
🔇 Additional comments (19)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (1)
v5/Dockerfile(1 hunks)
🧰 Additional context used
🪛 Checkov (3.2.334)
v5/Dockerfile
[LOW] 70-70: Ensure the base image uses a non latest version tag
(CKV_DOCKER_7)
🪛 Hadolint (2.12.0)
v5/Dockerfile
[warning] 34-34: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version>
(DL3018)
[warning] 62-62: Last USER should not be root
(DL3002)
[warning] 70-70: Always tag the version of an image explicitly
(DL3006)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: build_edge
v5/Dockerfile
Outdated
| RUN apk update && apk upgrade --no-cache \ | ||
| && apk add --no-cache --virtual .build-deps \ | ||
| g++ make python3 pkgconfig libc6-compat vips-dev \ | ||
| && apk add --no-cache bash curl tzdata |
There was a problem hiding this comment.
🧹 Nitpick (assertive)
Consider pinning package versions for reproducible builds
Using apk add without explicit version pins can lead to non-reproducible images when upstream packages update. You may define and use versioned args or specify package=version.
🧰 Tools
🪛 Hadolint (2.12.0)
[warning] 34-34: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version>
(DL3018)
🤖 Prompt for AI Agents
In v5/Dockerfile around lines 34 to 37, the apk packages are installed without
specifying versions, which can cause non-reproducible builds. To fix this, pin
the versions of each package by either defining ARG variables for the package
versions or specifying the exact version with the package name (e.g.,
package=version) in the apk add commands. This ensures consistent and
reproducible Docker images.
1 participant
Summary by CodeRabbit