CVEs in docker image

[omorsky-pcor]

Hello,
our CVE scanner found several vulnerabilities in the latest Azurite docker (3.37.0).
Among others, it is tar and brace-expansion.
Those packages are not direct nor indirect dependencies of Azurite, but they are dependencies of npm itself.
The current base image node:22-alpine3.23 contains npm@10.9.8, which depends on vulnerable packages.
I can fix it, I just need to know which way the maintainers want to go:

1. Updating npm is the cleanest way, but sooner or later a new CVE will be found and the update will have to happen again.

 RUN npm i -g npm@10.9.9

2. Deleting npm after build fixes it once and for all, however anyone using the Azurite docker image as a base will not be able to use npm — is there such a use case? Also, it is a hacky (yet official) way to remove npm.
   Something like:

 RUN rm -rf \
 /usr/local/lib/node_modules/npm \
 /usr/local/bin/npm \
 ...

3. Take a clean alpine image, copy node and azurite. The result is similar to 2) but leads to a smaller docker image:

 FROM alpine:3.23
 COPY --from=node:22-alpine3.23 /usr/local/bin/node /usr/local/bin/node
 COPY --from=deps /opt/azurite/ ./
 COPY --from=builder /opt/azurite/dist/ dist/
 ...

4. Claude noticed that Azurite does not need node to run at all, so having alpine + azurite should be enough. Thus, option 3) could be simplified to:

 FROM alpine:3.23
 COPY --from=builder /opt/azurite/release/azuritelinux /usr/local/bin/azurite

I checked it and I can say "it starts." The image is 212MB (vs current 595MB).

Any other ideas?

PS: Thanks for maintaining this project