From 216c6c4ef6c102bcbe333754be641cd037ff41ae Mon Sep 17 00:00:00 2001 From: Ryan Cook Date: Fri, 24 Oct 2025 14:27:16 -0400 Subject: [PATCH 1/2] switch to use UBI Signed-off-by: Ryan Cook --- components/frontend/Dockerfile | 43 +++++++++++++++++++++++----------- 1 file changed, 29 insertions(+), 14 deletions(-) diff --git a/components/frontend/Dockerfile b/components/frontend/Dockerfile index 2df74e6401..52ccd0810b 100644 --- a/components/frontend/Dockerfile +++ b/components/frontend/Dockerfile @@ -1,15 +1,22 @@ -FROM node:20-alpine AS deps -# Check https://github.com/nodejs/docker-node/tree/b4117f9333da4138b03a546ec926ef50a31506c3#nodealpine to understand why libc6-compat might be needed. -RUN apk add --no-cache libc6-compat +# Use Red Hat UBI Node.js 20 minimal image for dependencies +FROM registry.access.redhat.com/ubi9/nodejs-20-minimal AS deps + WORKDIR /app +USER 0 + # Install dependencies based on the preferred package manager COPY package.json package-lock.json* ./ RUN npm ci # Rebuild the source code only when needed -FROM node:20-alpine AS builder +FROM registry.access.redhat.com/ubi9/nodejs-20-minimal AS builder + +USER 0 + WORKDIR /app + +# Copy node_modules from deps stage COPY --from=deps /app/node_modules ./node_modules COPY . . @@ -21,28 +28,36 @@ ENV NEXT_TELEMETRY_DISABLED=1 RUN npm run build # Production image, copy all the files and run next -FROM node:20-alpine AS runner +FROM registry.access.redhat.com/ubi9/nodejs-20-minimal AS runner + WORKDIR /app ENV NODE_ENV=production # Uncomment the following line in case you want to disable telemetry during runtime. ENV NEXT_TELEMETRY_DISABLED=1 -RUN addgroup --system --gid 1001 nodejs -RUN adduser --system --uid 1001 nextjs - +# Copy public assets COPY --from=builder /app/public ./public -# Set the correct permission for prerender cache -RUN mkdir .next -RUN chown nextjs:nodejs .next +USER 0 + +# Create .next directory and set permissions for arbitrary UIDs +# OpenShift runs containers with random UIDs in the root group (GID 0) +# chmod g=u gives the root group the same permissions as the owner +RUN mkdir -p .next && \ + chmod -R g=u /app && \ + chgrp -R 0 /app # Automatically leverage output traces to reduce image size # https://nextjs.org/docs/advanced-features/output-file-tracing -COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./ -COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static +COPY --from=builder /app/.next/standalone ./ +COPY --from=builder /app/.next/static ./.next/static + +# Fix permissions after final copy +RUN chmod -R g=u /app && \ + chgrp -R 0 /app -USER nextjs +USER 1001 EXPOSE 3000 From e52f171491b474e0e35e7d2bc60294197e49a155 Mon Sep 17 00:00:00 2001 From: Ryan Cook Date: Fri, 24 Oct 2025 14:51:57 -0400 Subject: [PATCH 2/2] fix of suggest Signed-off-by: Ryan Cook --- components/frontend/Dockerfile | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/components/frontend/Dockerfile b/components/frontend/Dockerfile index 52ccd0810b..c656ac5acc 100644 --- a/components/frontend/Dockerfile +++ b/components/frontend/Dockerfile @@ -41,20 +41,16 @@ COPY --from=builder /app/public ./public USER 0 -# Create .next directory and set permissions for arbitrary UIDs -# OpenShift runs containers with random UIDs in the root group (GID 0) -# chmod g=u gives the root group the same permissions as the owner -RUN mkdir -p .next && \ - chmod -R g=u /app && \ - chgrp -R 0 /app - # Automatically leverage output traces to reduce image size # https://nextjs.org/docs/advanced-features/output-file-tracing COPY --from=builder /app/.next/standalone ./ COPY --from=builder /app/.next/static ./.next/static -# Fix permissions after final copy -RUN chmod -R g=u /app && \ +# Create directories and set permissions for OpenShift arbitrary UIDs +# OpenShift runs containers with random UIDs in the root group (GID 0) +# chmod g=u gives the root group the same permissions as the owner +RUN mkdir -p .next && \ + chmod -R g=u /app && \ chgrp -R 0 /app USER 1001 @@ -66,4 +62,4 @@ ENV HOSTNAME="0.0.0.0" # server.js is created by next build from the standalone output # https://nextjs.org/docs/pages/api-reference/next-config-js/output -CMD ["node", "server.js"] \ No newline at end of file +CMD ["node", "server.js"]