b9dfb86260
Security hardening release addressing CodeQL and Dependabot alerts: - Fix stack trace exposure in error responses - Add SSRF protection with DNS resolution checking - Implement proper URL hostname validation (replaces substring matching) - Add centralized path sanitization to prevent path traversal - Fix ReDoS vulnerability in email validation regex - Improve HTML sanitization in validation utilities - Fix capability wildcard matching in auth utilities - Update glob dependency to address CVE - Add CodeQL suppression comments for verified false positives 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
58 lines
1.5 KiB
Docker
58 lines
1.5 KiB
Docker
# Multi-stage production build for Control Panel Frontend
|
|
# Stage 1: Builder
|
|
FROM node:18-alpine AS builder
|
|
WORKDIR /app
|
|
|
|
# Install build dependencies
|
|
RUN apk add --no-cache python3 make g++ git
|
|
|
|
# Copy package files
|
|
COPY package.json ./
|
|
|
|
# Remove problematic dependencies (same as dev)
|
|
RUN sed -i '/"@radix-ui\/react-badge":/d; /"@radix-ui\/react-button":/d; /"@radix-ui\/react-card":/d; /"@radix-ui\/react-form":/d; /"@radix-ui\/react-input":/d; /"@radix-ui\/react-table":/d' package.json
|
|
RUN sed -i '/"@gt2\/types":/d; /"@gt2\/utils":/d' package.json
|
|
|
|
# Install dependencies
|
|
RUN npm install
|
|
|
|
# Copy source code
|
|
COPY . .
|
|
|
|
# Create mock packages
|
|
RUN mkdir -p node_modules/@gt2/types node_modules/@gt2/utils
|
|
RUN echo "export const GT2_VERSION = '1.0.0-dev';" > node_modules/@gt2/types/index.js
|
|
RUN echo "export const formatDate = (d) => new Date(d).toLocaleDateString();" > node_modules/@gt2/utils/index.js
|
|
|
|
# Build for production (this applies compiler.removeConsole)
|
|
ENV NODE_ENV=production
|
|
RUN npm run build
|
|
|
|
# Stage 2: Production Runner
|
|
FROM node:18-alpine AS runner
|
|
WORKDIR /app
|
|
|
|
ENV NODE_ENV=production
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
|
|
# Create non-root user
|
|
RUN addgroup --system --gid 1001 nodejs
|
|
RUN adduser --system --uid 1001 nextjs
|
|
|
|
# Copy necessary files from builder
|
|
COPY --from=builder /app/public ./public
|
|
COPY --from=builder /app/.next/standalone ./
|
|
COPY --from=builder /app/.next/static ./.next/static
|
|
|
|
# Set correct permissions
|
|
RUN chown -R nextjs:nodejs /app
|
|
|
|
USER nextjs
|
|
|
|
EXPOSE 3000
|
|
|
|
ENV PORT 3000
|
|
ENV HOSTNAME "0.0.0.0"
|
|
|
|
CMD ["node", "server.js"]
|