Docker Hub Scout Vulnerabilities with standalone nextjs

[pjanickovic-ph]

Hello,

I am not sure if this is a right forum, but I am getting high severity alerts on nextjs dockerized

building using node-22 alpine, latest stable nextjs...

Thanks for any help

[ideatrails]

I tried installing the latest shell-quote.
In my case I am using the Next standalone output config option, and it seems that the new shell-quote package did not carry over to the final image.

• using prune --docker option to optimize build time and output size.
• using pnpm for the package manager
• including docker scout bom and attestations.

build command: (in root of monorepo)

docker build --target=runner --progress plain --provenance=true --sbom=true --push -t ideas/udu:prod-0.3.0 . -f ./apps/web/Dockerfile --secret id=next_public_key,src=./secrets/next_public_key

As it turns out the docker scout bom and attestations ironically seem to be the issue, as without then the image has not critical or medium issues.

here is the build command: (in root of monorepo)

docker build --target=runner --progress plain --push -t ideas/udu:prod-0.3.0 . -f ./apps/web/Dockerfile --secret id=next_public_key,src=./secrets/next_public_key

here is the Dockerfile:

FROM node:alpine AS base

# First install the dependencies (as they change less often)
FROM base AS deps
RUN apk update
RUN apk add --no-cache libc6-compat
WORKDIR /app

RUN npm install -g turbo
COPY . .

# https://turbo.build/repo/docs/guides/tools/docker
# Prune --docker
# will make two directories for 
# 1: /app/out/json/ fo installing (deps stage)
# 2: /app/out/full/ for compiling source (install stage)
RUN turbo prune --scope=web --docker

FROM base AS installer
RUN apk update
RUN apk add --no-cache libc6-compat
WORKDIR /app

COPY .gitignore .gitignore
COPY --from=deps /app/out/json/ .
# RUN find . -mindepth 1 -maxdepth 5 \( ! -path "./node_modules/*" -a ! -path "./.git/*" \) -print
RUN \
  if [ -f yarn.lock ]; then yarn --frozen-lockfile; \
  elif [ -f package-lock.json ]; then npm ci; \
  elif [ -f pnpm-lock.yaml ]; then corepack enable pnpm && pnpm i --frozen-lockfile; \
  else echo "Lockfile not found." && exit 1; \
  fi

# Build the project
COPY --from=deps /app/out/full/ .
# RUN pnpm turbo run build

RUN --mount=type=secret,id=next_public_key \
  export NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=$(cat /run/secrets/next_public_key) && \
  pnpm turbo build

# Production image
FROM node:23.8.0-slim AS runner
WORKDIR /app

ENV NODE_ENV=production

RUN addgroup --system --gid 999 nodejs
RUN adduser --system --uid 999 nextjs

COPY --from=installer --chown=nextjs:nodejs /app/apps/web/.next/standalone ./
COPY --from=installer --chown=nextjs:nodejs /app/apps/web/.next/static ./apps/web/.next/static
COPY --from=installer --chown=nextjs:nodejs /app/apps/web/public ./apps/web/public

USER nextjs
EXPOSE 3000
ENV PORT=3000

# server.js is created by next build from the standalone output
# https://nextjs.org/docs/pages/api-reference/config/next-config-js/output
ENV HOSTNAME="0.0.0.0"
CMD ["node", "apps/web/server.js"] 
# CMD ["npm", "start"]

[ideatrails]

with compose file (in root of turborepo monorepo)
Command:

docker compose -f docker-compose.yml  --progress plain build

services:
  web:
    container_name: web
    # image: ideas/udu:prod-0.1.0
    build:
      context: .
      dockerfile: ./apps/web/Dockerfile
      target: runner
      tags:      
        - ideas/udu:prod-0.3.0
      secrets:
        - next_public_key
    restart: always
    ports: 
      - 3000:3000
    env_file:
      - ./apps/web/.env.local
    environment:
      NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY_FILE: /run/secrets/next_public_key

    networks:
      - app_network

secrets:
   next_public_key:
     file: ./secrets/next_public_key

# Define a network, which allows containers to communicate
# with each other, by using their container name as a hostname
networks:
  app_network:
    external: true