[FPurichaya]

Task

Task 6: Remote state

What changed

• Changed the API image from Node.js 24.21.0 to 24.22.1, the current 24 LTS patch. .nvmrc and the README prerequisite line match that version.
• Both stages in apps/api/Dockerfile use the official image node:24.22.1-bookworm-slim, pinned to the manifest-list digest sha256:55fb5f5a527ea2c5c4a95f963e48ef90aa38c7b346054fdc8ee9957a2b55d205.
• docker buildx imagetools inspect node:24.22.1-bookworm-slim reports media type application/vnd.oci.image.index.v1+json and includes linux/amd64 and linux/arm64.
• The image still builds from the repository root. The final stage runs node src/index.js as the node user with NODE_ENV=production, includes sql/001_counters.sql, and healthchecks GET /health with Node's built-in fetch.

How to verify

docker buildx imagetools inspect node:24.22.1-bookworm-slim
docker build -f apps/api/Dockerfile -t devops-task-api:task1 .
docker history devops-task-api:task1
docker inspect devops-task-api:task1 --format 'User={{.Config.User}} Env={{json .Config.Env}} Cmd={{json .Config.Cmd}}'

imagetools inspect digest: sha256:55fb5f5a527ea2c5c4a95f963e48ef90aa38c7b346054fdc8ee9957a2b55d205 (OCI image index).

docker history for the final stage, newest first:

CMD ["node" "src/index.js"]
HEALTHCHECK {Test:[CMD node -e fetch('http://127.0.0.1:' + (process.env.PORT || 3001) + '/health') ...]}
EXPOSE [3001/tcp]
USER node
COPY --chown=node:node /prod/api .
ENV NODE_ENV=production

docker inspect: User=node, Cmd=["node","src/index.js"]. The environment contains NODE_ENV=production and NODE_VERSION=24.22.1. It does not contain DATABASE_URL.

Inside the image: uid 1000, Node v24.22.1, sql/001_counters.sql present. No .git or .env file.

docker run --rm devops-task-api:task1 exits 1 with Missing required environment variable DATABASE_URL. GET /health stays unhealthy until Postgres and Valkey are wired in Task 3. The healthcheck does not call POST /api/clicks.

Security checklist

• Third-party GitHub Actions are pinned to a full 40-character commit SHA, with the release tag in a trailing comment
• Third-party container images are pinned by manifest-list digest, with the version tag recorded next to the digest
• No latest image tags and no floating action tags (@v4, @main)
• No secrets in git, Dockerfiles, image layers, or workflow logs
• Workflow permissions are set explicitly and are no broader than the job needs
• Application containers run as a non-root user
• Postgres and Valkey are not published on a public interface
• apps/ behavior is unchanged, except operational configuration this task allows
• OpenTofu providers and modules are pinned to an exact version, and .terraform.lock.hcl is committed
• No state files, kubeconfigs, AWS keys, or passwords in git
• No 0.0.0.0/0 on the EKS API or the web load balancer
• No GitHub Actions job applies or destroys infrastructure
• Fork pull requests cannot assume the AWS plan role

Exceptions

Use the API image Node.js 24.22.1 as it is the current patch on the 24 LTS line.