github-community-projects / github-community-projects/private-mirrors

Migrate to hardened docker images

Open
#441 5 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
TypeScript
Stars
196
Forks
41
Avg merge
1d 9h
Merged PRs (30d)
4

Description

### Is your feature request related to a problem?

The current docker images used by private mirrors contain many dependencies that are unnecessary to the functioning of the app and present a vulnerability risk.

### Describe the solution you'd like

Docker published [Docker Hardened Images for Node.js](https://hub.docker.com/hardened-images/catalog/dhi/node/images) that should reduce the number of unnecessary dependencies in the private mirrors images.

### Describe alternatives you've considered

Alternatively the current private mirrors Dockerfile could have logic added to remove unnecessary dependencies but this has the risk of not being thorough or unintentionally breaking things.

### Additional context

As part of this change the Dockerfile will need to be updated to not use an npm script as the final command in favor of directly executing the transpiled Javascript with node. There may also be complications due to the use of simple-git in private mirrors which will require testing to ensure that the new images still have the necessary dependencies.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.