Use a distroless Node.js runtime image

api-docs/openapi.json

@@ -11,7 +11,7 @@
   },
   "servers": [
     {
-      "url": "https://cveawg-dev.mitre.org/api"
+      "url": "/api"
     }
   ],
   "paths": {

docker/Dockerfile

@@ -1,41 +1,58 @@
-FROM node:24-alpine3.22
+FROM node:24.18.0-trixie-slim@sha256:ae91dcc111a68c9d2d81ff2a17bda61be126426176fde6fe7d08ab13b7f50573 AS build
 
 LABEL \
     mitre.name=cveawg \
-    mitre.project=cveawg 
+    mitre.project=cveawg
 
-ENV PIP_BREAK_SYSTEM_PACKAGES=1
-# Run an optional pre-flight script for host-dependent reqs such as CA certs
-# Use --build-arg:
-# docker compose --build-arg CVE_PREFLIGHT="wget -q -O - --no-check-certificate http://pki.local/install_certs.sh | sh"
+# Run an optional pre-flight script for host-dependent requirements such as
+# corporate CA certificates before package installation performs network I/O.
 ARG CVE_PREFLIGHT
-RUN sh -c "${CVE_PREFLIGHT:-exit 0}"
+RUN /bin/sh -c "${CVE_PREFLIGHT:-exit 0}"
 
-# Install python/pip (required for argon2 build from source)
-ENV PYTHONUNBUFFERED=1
-RUN apk add --update --no-cache python3 py3-pip
-RUN pip3 install --no-cache --upgrade pip setuptools
+# Python and build essentials are required when argon2 builds from source.
+RUN apt-get update \
+    && apt-get install --yes --no-install-recommends python3 make g++ ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
 
-# Install build essentials (also required for argon2)
-RUN apk add --update --no-cache build-base
+WORKDIR /app
 
-# Set up directory to run as node user rather than root
-ADD . /home/node/app
-RUN rm -Rf /home/node/app/.git # we don't need this
-RUN chown -R node:node /home/node
+COPY package.json package-lock.json ./
+RUN npm ci
 
-WORKDIR /home/node/app
+COPY src ./src
+COPY schemas ./schemas
+COPY api-docs ./api-docs
+COPY config ./config
+COPY docker/default.json-docker ./config/default.json
+RUN for environment in development staging integration production test; do \
+      printf '{}\n' > "./config/${environment}.json"; \
+    done
 
-RUN npm install --production
-COPY --chown=node:node docker/entrypoint.sh /home/node/app/entrypoint.sh
-RUN echo '{}' > /home/node/app/config/dev.json
-RUN echo '{}' > /home/node/app/config/test.json
-RUN echo '{}' > /home/node/app/config/staging.json
+# Generate the OpenAPI artifact while build-only dependencies are available,
+# then remove them before copying node_modules into the runtime image.
+RUN node src/swagger.js \
+    && npm prune --omit=dev \
+    && npm cache clean --force
 
-# Change db hostname from localhost to docdb for use inside docker
-COPY docker/default.json-docker /home/node/app/config/default.json
+FROM gcr.io/distroless/nodejs24-debian13:nonroot@sha256:af85d11ce7ef10172855a6e3649e3e8125b1b9e3ca41849ec2918036f05cb212 AS runtime
+
+LABEL \
+    mitre.name=cveawg \
+    mitre.project=cveawg
+
+ENV NODE_ENV=production
+
+WORKDIR /app
+
+# Preserve any custom CA certificates installed by CVE_PREFLIGHT in the build
+# stage. The application otherwise runs with a read-only application tree.
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=build --chown=65532:65532 /app/node_modules ./node_modules
+COPY --from=build --chown=65532:65532 /app/package.json ./package.json
+COPY --from=build --chown=65532:65532 /app/src ./src
+COPY --from=build --chown=65532:65532 /app/schemas ./schemas
+COPY --from=build --chown=65532:65532 /app/api-docs ./api-docs
+COPY --from=build --chown=65532:65532 /app/config ./config
 
-# Run as the node user rather than root
-USER node
 EXPOSE 3000
-ENTRYPOINT '/home/node/app/entrypoint.sh'
+CMD ["src/scripts/start.js"]