mirror of
https://github.com/makeplane/plane.git
synced 2026-07-09 20:10:06 +02:00
498f857be4
Resolves the sole open Dependabot alert (GHSA-gv7w-rqvm-qjhr, high): esbuild <0.28.1 lacks binary-integrity verification in its Deno install path, enabling RCE via NPM_CONFIG_REGISTRY. The pnpm `overrides` entry pinned the entire tree to esbuild 0.25.0; bump it to 0.28.1, which fixes all transitive paths (vite, vitest, tsx, vite-node, esbuild-register). Also bump turbo 2.9.14 -> 2.9.18 in the workspace catalog and the four pinned production Dockerfiles (web, live, admin, space). Verified: `pnpm audit` clean, admin react-router/vite build succeeds, @plane/codemods vitest suite 33/33 passing.
77 lines
2.9 KiB
Docker
77 lines
2.9 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
FROM node:22-alpine AS base
|
|
|
|
# Setup pnpm package manager with corepack and configure global bin directory for caching
|
|
ENV PNPM_HOME="/pnpm"
|
|
ENV PATH="$PNPM_HOME:$PNPM_HOME/bin:$PATH"
|
|
RUN corepack enable
|
|
|
|
# *****************************************************************************
|
|
# STAGE 1: Prune the project
|
|
# *****************************************************************************
|
|
FROM base AS builder
|
|
# Check https://github.com/nodejs/docker-node/tree/b4117f9333da4138b03a546ec926ef50a31506c3#nodealpine to understand why libc6-compat might be needed.
|
|
RUN apk update
|
|
RUN apk add --no-cache libc6-compat
|
|
# Set working directory
|
|
WORKDIR /app
|
|
ARG TURBO_VERSION=2.9.18
|
|
RUN corepack enable pnpm && pnpm add -g turbo@${TURBO_VERSION}
|
|
COPY . .
|
|
RUN turbo prune --scope=live --docker
|
|
|
|
# *****************************************************************************
|
|
# STAGE 2: Install dependencies & build the project
|
|
# *****************************************************************************
|
|
# Add lockfile and package.json's of isolated subworkspace
|
|
FROM base AS installer
|
|
RUN apk update
|
|
RUN apk add --no-cache libc6-compat
|
|
WORKDIR /app
|
|
|
|
# First install dependencies (as they change less often)
|
|
COPY .gitignore .gitignore
|
|
COPY --from=builder /app/out/json/ .
|
|
COPY --from=builder /app/out/pnpm-lock.yaml ./pnpm-lock.yaml
|
|
RUN corepack enable pnpm
|
|
|
|
# Copy full directory structure before fetch to ensure all package.json files are available
|
|
COPY --from=builder /app/out/full/ .
|
|
COPY turbo.json turbo.json
|
|
|
|
# Fetch dependencies to cache store, then install offline with dev deps
|
|
RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store pnpm fetch --store-dir=/pnpm/store
|
|
RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store CI=true pnpm install --offline --frozen-lockfile --store-dir=/pnpm/store
|
|
|
|
ENV TURBO_TELEMETRY_DISABLED=1
|
|
|
|
RUN pnpm turbo run build --filter=live
|
|
|
|
# *****************************************************************************
|
|
# STAGE 3: Run the project
|
|
# *****************************************************************************
|
|
|
|
FROM base AS runner
|
|
WORKDIR /app
|
|
|
|
# Remove go from Alpine APK database; not needed at runtime and carries stdlib CVEs
|
|
RUN apk del go 2>/dev/null || true
|
|
|
|
# Remove vulnerable picomatch bundled inside npm (CVE-2026-33671); npm is not used at runtime
|
|
RUN rm -rf /usr/local/lib/node_modules/npm/node_modules/picomatch
|
|
|
|
COPY --from=installer /app/packages ./packages
|
|
COPY --from=installer /app/apps/live/dist ./apps/live/dist
|
|
COPY --from=installer /app/apps/live/node_modules ./apps/live/node_modules
|
|
COPY --from=installer /app/node_modules ./node_modules
|
|
COPY --from=installer /app/apps/live/package.json ./apps/live/package.json
|
|
|
|
# esbuild and tsgolint are build-only Go binaries; remove from runtime image to eliminate stdlib CVEs
|
|
RUN find /app/node_modules \( -name 'esbuild' -o -name 'tsgolint' \) -type f -delete 2>/dev/null || true
|
|
|
|
ENV TURBO_TELEMETRY_DISABLED=1
|
|
|
|
EXPOSE 3000
|
|
|
|
CMD ["node", "apps/live"]
|