Repository navigation
Lint and harden the Dockerfile - #2492
Merged
Merged
Conversation
Lint the Dockerfile with hadolint in a new CI job and fix its findings: pipefail in the base stage, --no-install-recommends in the runtime stage, fewer RUN layers and a numeric runtime user. Harden the image: - Verify the Node.js and bun downloads against the GPG-signed SHASUMS256.txt of each release, like the official node and oven/bun images. Node.js was installed by the NodeSource setup script and bun by bun.sh/install, both unverified. Node.js is now pinned and updated by Renovate. - Vendor env-secrets-expand.sh instead of downloading it on every build. - Only /opt/app belongs to nobody, so the release cannot modify the entrypoint scripts.
Flo0807
added
docker
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Nov 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lint
A new CI job
Lint Dockerfileruns hadolint (viahadolint/hadolint-actionv3.5.0, hadolint 2.15.1). The config is in.hadolint.yaml, and CONTRIBUTING.md › Dockerfile shows how to run it locally.Fixed findings:
SHELLwithpipefailin the base stage (DL4006)--no-install-recommendsandrm -rf /var/lib/apt/lists/*in the runtime stage (DL3015, DL3009)RUN mkdir demoremoved,WORKDIRcreates the directory;mix compileandmix assets.deployin oneRUN(DL3059)65534:65534(nobody:nogroup), so a runtime can check that the user is not root (DL3066)Ignored:
compose.yml), so it keeps recommended packages such asopenssh-clientandlessforgit.mix do …: ShellCheck mistakes the mix task for the shell keyword.cds into a temporary directory that the sameRUNremoves.Hardening
curl … | bash), bun frombun.sh/install, neither checked. Both now download the release and verify it against its GPG-signedSHASUMS256.txt, like the officialnodeandoven/bunimages: Node.js only accepts the release keys listed in the Dockerfile, bun only its signing key. On amd64 bun uses thex64-baselinebuild, so it also runs on CPUs without AVX2.NODE_VERSION=26.13.0, same major as CI) and updated by Renovate instead of following the current LTS.env-secrets-expand.shis vendored into.docker/opt/scripts/(same commited67c79as before, source noted in the header) instead of being downloaded withADDon every build./opt/appbelongs tonobodyin the runtime image. Before,chown -R nobody /optlet the release process overwrite the entrypoint scripts in/opt/scripts.Checked
docker build --target runtime(arm64): the Node.js signature and checksum verify (Good signature,node-v26.13.0-linux-arm64.tar.xz: OK).Build and push image (Demo)job of this PR builds the image on amd64.Follow-up
Once this is merged,
Lint Dockerfilebecomes a required check ondevelop.