wtclaude
2a6e307f16
CVE-2026-111497 ("Node2Shell") is an out-of-bounds write in the Brotli
decoder Node bundles; it was fixed on 2026-10-21 in 22.23.4, 24.22.1 and
26.12.1. Both images were on node:20-alpine, and Node 20 is past end of
life, so it gets no fix.
The site is not reachable through the main path (Express 4 / body-parser
1.20 refuse a `br` request body with 415, and nothing calls the zlib
Brotli API), but fetch() decodes Brotli responses and the runtime itself
was unpatched. Pin the exact patched version so a floating tag cannot
hold an old build, and run CI on the same version the image ships.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
35 lines
1.2 KiB
Docker
35 lines
1.2 KiB
Docker
FROM node:22.23.4-alpine
|
|
|
|
WORKDIR /app
|
|
|
|
# Install server deps first for better layer caching (production only).
|
|
COPY server/package*.json server/
|
|
RUN npm install --prefix server --omit=dev
|
|
|
|
# Copy the rest of the repo. .dockerignore keeps node_modules/.env/_reference out,
|
|
# so the server deps installed above are preserved.
|
|
COPY . .
|
|
|
|
# Build the client if it is present (added in the frontend phase). Until then the
|
|
# server runs API-only and serves a placeholder at /.
|
|
RUN if [ -f client/package.json ]; then \
|
|
npm install --prefix client && npm run build --prefix client; \
|
|
else \
|
|
echo "No client/ present — building server-only image"; \
|
|
fi
|
|
|
|
# Persistent uploads + logs live on mounted volumes.
|
|
RUN mkdir -p /app/uploads /app/logs && chown -R node:node /app/uploads /app/logs
|
|
|
|
# Installed modules are mounted in too (docker-compose.yml), and .dockerignore
|
|
# keeps any local modules/ OUT of the image — a module must never be baked in.
|
|
# The directory is still created here so a container run without the mount finds
|
|
# an empty, writable modules dir rather than no directory at all.
|
|
RUN mkdir -p /app/modules && chown node:node /app/modules
|
|
|
|
USER node
|
|
|
|
EXPOSE 3000
|
|
|
|
CMD ["npm", "start", "--prefix", "server"]
|