mirror of
https://github.com/suitenumerique/meet.git
synced 2026-09-07 16:05:39 +00:00
lebaudantoine
80dfaf43dc
Bump the frontend base image to `1.30.4-alpine3.24`, which picks up fixes for the CVEs listed below and lets us drop the individual dependency pins that were only there to address earlier known CVEs. Address the following HIGH severity CVEs in libuuid / util-linux, reported by Trivy. Bumping to 2.41.6-r1 (bundled in the new base image) covers all of them: * CVE-2026-53612 — TOCTOU in mount post-mount ownership/mode changes. * CVE-2026-53613 — TOCTOU in mount via ancestor directory swap. * CVE-2026-53614 — SUID mount(8) nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2. * CVE-2026-76642 — failed external mount helper still runs privileged X-mount post-hooks. * CVE-2026-78408 — nsenter --join-cgroup leaks root cgroup migration authority (fixed in 2.41.6-r1). * CVE-2026-78410 — restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode escalation.
83 lines
1.8 KiB
Docker
83 lines
1.8 KiB
Docker
# ---- Front-end image ----
|
|
FROM node:22-alpine AS frontend-deps
|
|
|
|
WORKDIR /home/frontend/
|
|
|
|
COPY ./src/frontend/package.json ./package.json
|
|
COPY ./src/frontend/package-lock.json ./package-lock.json
|
|
|
|
RUN npm ci
|
|
|
|
COPY .dockerignore ./.dockerignore
|
|
COPY ./src/frontend/ .
|
|
|
|
# ---- Front-end builder image ----
|
|
FROM frontend-deps AS meet-builder
|
|
|
|
WORKDIR /home/frontend
|
|
|
|
ENV VITE_APP_TITLE="Visio"
|
|
ENV VITE_BUILD_SOURCEMAP="true"
|
|
|
|
RUN npm run build
|
|
|
|
# Inject PostHog sourcemap metadata into the built assets
|
|
# This metadata is essential for correctly mapping errors to source maps in production
|
|
RUN set -e && \
|
|
npx @posthog/cli@0.4.8 sourcemap inject --directory ./dist/assets
|
|
|
|
COPY ./docker/dinum-frontend/dinum-styles.css \
|
|
./dist/assets/
|
|
|
|
COPY ./docker/dinum-frontend/logo.svg \
|
|
./dist/assets/logo.svg
|
|
|
|
COPY ./docker/dinum-frontend/assets/ \
|
|
./dist/assets/
|
|
|
|
COPY ./docker/dinum-frontend/fonts/ \
|
|
./dist/assets/fonts/
|
|
|
|
# ---- Addons builder image ----
|
|
FROM node:20-alpine AS addons-builder
|
|
|
|
WORKDIR /home/addons/outlook
|
|
|
|
COPY ./src/addons/outlook/package.json ./package.json
|
|
COPY ./src/addons/outlook/package-lock.json ./package-lock.json
|
|
|
|
RUN npm ci
|
|
|
|
COPY ./src/addons/outlook/ .
|
|
|
|
RUN npx webpack --mode production
|
|
|
|
|
|
# ---- Front-end image ----
|
|
FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
|
|
|
|
USER root
|
|
RUN apk del curl
|
|
USER nginx
|
|
|
|
USER nginx
|
|
|
|
# Un-privileged user running the application
|
|
ARG DOCKER_USER
|
|
USER ${DOCKER_USER}
|
|
|
|
COPY --from=meet-builder \
|
|
/home/frontend/dist \
|
|
/usr/share/nginx/html
|
|
|
|
COPY --from=addons-builder \
|
|
/home/addons/outlook/dist \
|
|
/usr/share/nginx/html/addons/outlook
|
|
|
|
COPY ./docker/dinum-frontend/nginx/default.conf /etc/nginx/conf.d
|
|
COPY ./docker/files/usr/local/bin/entrypoint /usr/local/bin/entrypoint
|
|
|
|
ENTRYPOINT [ "/usr/local/bin/entrypoint" ]
|
|
|
|
CMD ["nginx", "-g", "daemon off;"]
|