Charles BochetandGitHub
14acd77626
## Summary - ECR Inspector flagged 9 CVEs on the `prod-twenty` image — 8 PostgreSQL CVEs on `postgresql18-18.3-r0` (pulled in transitively by `apk add postgresql-client`) and CVE-2026-27135 on `nghttp2-1.68.0-r0` (pulled in by `curl` / `aws-cli`). - Alpine 3.23 already ships patched `postgresql18-18.4-r0` and `nghttp2-1.69.0-r0`, but the GHA buildx cache was reusing the stale `apk add` layer because `FROM node:24-alpine` had not moved. - Pinning the base image to `node:24.15.0-alpine3.23@sha256:8e2c930f…` forces a layer cache miss, picks up the patched apk packages, and gives Dependabot/Renovate a stable target for future digest bumps. Applied to both [packages/twenty-docker/twenty/Dockerfile](https://github.com/twentyhq/twenty/blob/charles/trusting-solomon-259ec8/packages/twenty-docker/twenty/Dockerfile) (4 stages → ECR `prod-twenty`) and [packages/twenty-docker/twenty-website-new/Dockerfile](https://github.com/twentyhq/twenty/blob/charles/trusting-solomon-259ec8/packages/twenty-docker/twenty-website-new/Dockerfile) (2 stages). ## Test plan - [ ] CI builds both images successfully on amd64 + arm64 - [ ] After merge + deploy, re-run ECR Inspector on the new `prod-twenty` image and confirm the 9 CVEs (CVE-2026-6473/6474/6475/6476/6477/6478/6479/6637 + CVE-2026-27135) are gone - [ ] Smoke-test the staging deployment (server boot, DB migrations via `psql` in the entrypoint)
40 lines
1.3 KiB
Docker
40 lines
1.3 KiB
Docker
FROM node:24.15.0-alpine3.23@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS twenty-website-new-build
|
|
|
|
|
|
WORKDIR /app
|
|
|
|
COPY ./package.json .
|
|
COPY ./yarn.lock .
|
|
COPY ./.yarnrc.yml .
|
|
COPY ./tsconfig.base.json .
|
|
COPY ./nx.json .
|
|
COPY ./.yarn/releases /app/.yarn/releases
|
|
COPY ./.yarn/patches /app/.yarn/patches
|
|
COPY ./packages/twenty-oxlint-rules /app/packages/twenty-oxlint-rules
|
|
COPY ./packages/twenty-shared/package.json /app/packages/twenty-shared/package.json
|
|
COPY ./packages/twenty-website-new/package.json /app/packages/twenty-website-new/package.json
|
|
|
|
RUN yarn
|
|
|
|
COPY ./packages/twenty-shared /app/packages/twenty-shared
|
|
COPY ./packages/twenty-website-new /app/packages/twenty-website-new
|
|
RUN npx nx build twenty-website-new
|
|
|
|
FROM node:24.15.0-alpine3.23@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS twenty-website-new
|
|
|
|
WORKDIR /app/packages/twenty-website-new
|
|
|
|
COPY --from=twenty-website-new-build /app /app
|
|
|
|
WORKDIR /app/packages/twenty-website-new
|
|
|
|
LABEL org.opencontainers.image.source=https://github.com/twentyhq/twenty
|
|
LABEL org.opencontainers.image.description="This image provides a consistent and reproducible environment for the new marketing website."
|
|
|
|
RUN chown -R 1000 /app
|
|
|
|
# Use non root user with uid 1000
|
|
USER 1000
|
|
|
|
CMD ["/bin/sh", "-c", "npx nx start twenty-website-new"]
|