Container security

[lasseklovstad]

Mounting volumes into Docker containers is safe as long as you properly manage file permissions. Ensure the volume is only writable by the container user, and limit access to sensitive data.

FROM node:20.17-alpine3.20 as base

LABEL fly_launch_runtime="Remix"

# Create a non-root user
RUN addgroup -S appgroup && adduser -S appuser -G appgroup

# Remix app lives here
WORKDIR /app

# Set production environment
ENV NODE_ENV=production
ENV APP_DATABASE_URL=/data/sqlite.db

# Create the data directory and set permissions
RUN mkdir /data && chown appuser:appgroup /data && chmod 755 /data

# Throw-away build stage to reduce size of final image
FROM base as build

# Install node modules
COPY --link package-lock.json package.json ./
RUN npm ci --include=dev

# Copy application code
COPY --link . .

# Build application
RUN npm run build

# Remove development dependencies
RUN npm prune --omit=dev

# Final stage for app image
FROM base

# Copy built application
COPY --from=build /app/build /app/build
COPY --from=build /app/node_modules /app/node_modules
COPY --from=build /app/package.json /app/package.json
COPY --from=build /app/server.mjs /app/server.mjs
COPY --from=build /app/migrations /app/migrations

# Ensure the non-root user has access to /data
RUN chown -R appuser:appgroup /app /data

# Switch to the non-root user
USER appuser

# Start the server by default, this can be overwritten at runtime
EXPOSE 3000
CMD [ "npm", "run", "start" ]

Fra chat
https://chatgpt.com/c/6710066e-1cc4-800e-8617-751009d1d33d