WebsocketServer container build optimization

Hello,

at first : thanks for this nice integration.

I tested the "Whiteboard Collaboration Server" websocket_server and noticed some points.

Are these already on the Roadmap ?

The Dockerfile currently copies/deploy the whole app into the container - where only the backend server is required.

I would recommend to add to the websocket_server a own package.json with only the required dependencies. (see below for a short sample)

On building the Container - now we can simple build the backend only.
(very simple js without a real "building" )

This make the container smaller with less dependencies.

Second Point:
Is it a security Problem that the endpoints /status / are not protected by a API Token ?
If used - this would be open the world - and expose information - someone perhaps give hints how to make bad things. ;)

Last but not important:
The logging is very loud. Anyone has planed to split console.log into console.debug and make it optional disable by ENV ?

Example package.json for server:

{
  "name": "whiteboard-server",
  "version": "1.0.5",
  "license": "AGPL-3.0-or-later",
  "private": true,
  "type": "module",
  "main": "main.js",
  "scripts": {
    "lint": "eslint --ext .js,.mjs,.ts,.tsx,.vue .",
    "lint:fix": "eslint --ext .js,.mjs,.ts,.tsx,.vue . --fix",
    "server:start": "node main.js",
    "server:watch": "nodemon main.js"
  },
  "dependencies": {
    "@socket.io/redis-streams-adapter": "^0.2.2",
    "axios": "^1.9.0",
    "dotenv": "^16.4.7",
    "express": "^5.0.1",
    "jsonwebtoken": "^9.0.2",
    "lru-cache": "^11.0.2",
    "prom-client": "<15",
    "redis": "^5.0.0",
    "socket.io": "^4.8.1",
    "socket.io-prometheus": "^0.3.0"
  },
  "devDependencies": {
    "nodemon": "^3.1.9",
    "prettier": "^3.5.3"
  },
  "prettier": {
    "useTabs": true,
    "semi": false,
    "singleQuote": true,
    "bracketSameLine": true,
    "tabWidth": 4
  },
  "browserslist": [
  ],
  "eslintConfig": {
    "extends": [
    ],
    "rules": {
      "jsdoc/require-jsdoc": "off"
    }
  },
  "engines": {
    "node": "^23",
    "npm": ">10"
  }
}

Example new Dockerfile for server:

# syntax=docker/dockerfile:latest
FROM node:23-alpine AS base
ARG NODE_ENV=production
WORKDIR /app
RUN apk upgrade --no-cache -a && \
    apk add --no-cache ca-certificates
COPY websocket_server /app

FROM base AS build
#SHELL ["/bin/ash", "-eo", "pipefail", "-c"]
ARG NODE_ENV=production
RUN npm install --omit dev --omit peer --omit optional --prefer-dedupe --no-fund

FROM base
COPY --from=build --chown=nobody:nobody /app /app
WORKDIR /app
USER nobody
EXPOSE 3002
ENTRYPOINT ["node", "main.js"]
HEALTHCHECK CMD nc -z 127.0.0.1 3002 || exit 1

Example .dockerignore

*
!websocket_server
websocket_server/node_modules

Start by inspecting the current Dockerfile and the websocket_server directory, including its dependency declarations and container entry point. Review the handlers for /status and / and the server's console.log calls. Done requires an agreed scope covering the container contents, endpoint protection, and configurable logging, with tests or build checks demonstrating each selected change.