fix(docker): remove bundled npm from runner to clear Trivy CVEs #4

Merged
jason.woltje merged 1 commits from fix/trivy-remove-bundled-npm into main 2026-04-14 03:49:54 +00:00

View File

@@ -40,6 +40,8 @@ ENV NODE_ENV=production \
RUN addgroup -g 1001 -S nodejs && adduser -S -u 1001 -G nodejs nextjs
RUN apk upgrade --no-cache && \
apk add --no-cache wget && \
rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack \
/usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack && \
mkdir -p /app/media && \
chown -R nextjs:nodejs /app
COPY --from=build --chown=nextjs:nodejs /app/public ./public