Add Dockerfile for Node.js application setup#603
Add Dockerfile for Node.js application setup#603shhhaddd wants to merge 1 commit intositeboon:mainfrom
Conversation
📝 WalkthroughWalkthroughA new Dockerfile was introduced to containerize a Node.js application. It uses node:20-slim as the base image, installs Python 3 and build tools, configures the working directory, installs dependencies via npm ci, builds the project, and runs the server on port 3001. Changes
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
Dockerfile (1)
3-5: Add--no-install-recommendsto reduce image size.The
apt-get installcommand should include--no-install-recommendsto avoid installing unnecessary recommended packages, reducing the final image size.♻️ Proposed fix
-RUN apt-get update && apt-get install -y \ +RUN apt-get update && apt-get install -y --no-install-recommends \ python3 make g++ \ && rm -rf /var/lib/apt/lists/*🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@Dockerfile` around lines 3 - 5, The apt-get install invocation in the Dockerfile should be changed to include --no-install-recommends to avoid pulling recommended packages and reduce image size; update the RUN line that currently executes "apt-get update && apt-get install -y python3 make g++" to add --no-install-recommends immediately after install (and keep the existing cleanup of /var/lib/apt/lists/*), ensuring the rest of the RUN chain (apt-get update, install, and rm -rf) remains intact.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@Dockerfile`:
- Line 1: The Dockerfile currently runs as root (base image FROM node:20-slim);
add a non-root user and switch to it before the CMD to avoid running the Node
process as root. Create a dedicated user/group (e.g., "app" or "nodeuser"),
ensure application directories (build output, node_modules, and any runtime
writable dirs) are chowned to that user, and add a USER instruction to switch to
that non-root user prior to the final CMD; adjust any file permissions or
ownership in the Dockerfile steps that create files (e.g., after npm install or
copying files) so the non-root user can read/write them.
- Around line 13-14: The Dockerfile sets ENV PORT=3001 but the server reads
process.env.SERVER_PORT (default 3001), so update the Dockerfile to set ENV
SERVER_PORT=3001 (and keep EXPOSE 3001) so the container env matches the server;
locate the ENV line that sets PORT and replace or add SERVER_PORT to ensure the
server picks up the configured port.
---
Nitpick comments:
In `@Dockerfile`:
- Around line 3-5: The apt-get install invocation in the Dockerfile should be
changed to include --no-install-recommends to avoid pulling recommended packages
and reduce image size; update the RUN line that currently executes "apt-get
update && apt-get install -y python3 make g++" to add --no-install-recommends
immediately after install (and keep the existing cleanup of
/var/lib/apt/lists/*), ensuring the rest of the RUN chain (apt-get update,
install, and rm -rf) remains intact.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| @@ -0,0 +1,15 @@ | |||
| FROM node:20-slim | |||
There was a problem hiding this comment.
Container runs as root, which is a security risk.
The container runs the Node.js server as the root user. This increases the attack surface if the application is compromised. Add a non-root user before the CMD instruction.
🔒 Proposed fix
FROM node:20-slim
RUN apt-get update && apt-get install -y --no-install-recommends \
python3 make g++ \
&& rm -rf /var/lib/apt/lists/*
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build
+# Run as non-root user for security
+RUN addgroup --system --gid 1001 nodejs && \
+ adduser --system --uid 1001 --ingroup nodejs nodeuser && \
+ chown -R nodeuser:nodejs /app
+USER nodeuser
+
ENV SERVER_PORT=3001
EXPOSE 3001
CMD ["node", "server/index.js"]Also applies to: 15-15
🧰 Tools
🪛 Trivy (0.69.3)
[error] 1-1: Image user should not be 'root'
Specify at least 1 USER command in Dockerfile with non-root user as argument
Rule: DS-0002
(IaC/Dockerfile)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@Dockerfile` at line 1, The Dockerfile currently runs as root (base image FROM
node:20-slim); add a non-root user and switch to it before the CMD to avoid
running the Node process as root. Create a dedicated user/group (e.g., "app" or
"nodeuser"), ensure application directories (build output, node_modules, and any
runtime writable dirs) are chowned to that user, and add a USER instruction to
switch to that non-root user prior to the final CMD; adjust any file permissions
or ownership in the Dockerfile steps that create files (e.g., after npm install
or copying files) so the non-root user can read/write them.
| ENV PORT=3001 | ||
| EXPOSE 3001 |
There was a problem hiding this comment.
Environment variable name mismatch: PORT vs SERVER_PORT.
The server reads process.env.SERVER_PORT (with fallback to 3001), not process.env.PORT. Setting ENV PORT=3001 has no effect on the server's port binding.
🐛 Proposed fix
-ENV PORT=3001
+ENV SERVER_PORT=3001
EXPOSE 3001📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ENV PORT=3001 | |
| EXPOSE 3001 | |
| ENV SERVER_PORT=3001 | |
| EXPOSE 3001 |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@Dockerfile` around lines 13 - 14, The Dockerfile sets ENV PORT=3001 but the
server reads process.env.SERVER_PORT (default 3001), so update the Dockerfile to
set ENV SERVER_PORT=3001 (and keep EXPOSE 3001) so the container env matches the
server; locate the ENV line that sets PORT and replace or add SERVER_PORT to
ensure the server picks up the configured port.
1 participant
Summary by CodeRabbit