Hardened Dockerfile

Author: xlvnacyx

.gitignore

@@ -30,6 +30,7 @@ ehthumbs.db
 Thumbs.db
 
 # IDE files
+.devcontainer/
 .vscode/
 .idea/
 *.swp

Dockerfile

@@ -9,6 +9,9 @@ COPY package*.json ./
 COPY tsconfig.json ./
 COPY src/ ./src/
 
+# Ensure latest NPM
+RUN npm i -g npm@latest
+
 # Install ALL dependencies (including dev dependencies for building)
 RUN npm ci
 
@@ -38,6 +41,16 @@ RUN npm ci --omit=dev --ignore-scripts && npm cache clean --force
 # Change ownership to nodejs user
 RUN chown -R nodejs:nodejs /app
 
+# Remove unnecessary binaries and tools to harden the image
+RUN rm -rf /usr/local/bin/docker-entrypoint.sh \
+    /usr/local/bin/npm \
+    /usr/local/bin/npx \
+    /usr/local/lib/node_modules/npm \
+    /usr/local/lib/node_modules/corepack && \
+    find /bin /sbin /usr/bin /usr/sbin -type f \( \
+        -name "apk" -o -name "apk-tools" -o -name "openssh*" \
+    \) -delete 2>/dev/null || true
+
 # Switch to nodejs user
 USER nodejs