Docker Image Updates and Security Enhancements (#1)

# Overview This PR introduces several improvements to our Docker infrastructure, focusing on security, base image optimization, and workflow automation. # Key Changes ## Base Image Updates - Updated system package installation and cleanup processes ## Security Enhancements - Implemented Trivy security scanning in the Dockerfile - Adjusted Trivy scan configuration to handle known Debian vulnerabilities - Enhanced container security by ensuring proper ownership of `/workspaces` directory ## CI/CD Improvements - Added manual workflow dispatch capability to Docker workflows - Implemented cron scheduling for automated builds - Enhanced Docker image configuration and build process # Technical Details - Trivy security scanning is now implemented using a script-based installation method - Workflow improvements allow both scheduled and manual triggering of Docker builds # Security Considerations - Trivy scan exit code has been set to 0 to accommodate known Debian vulnerabilities while maintaining security awareness - Proper directory permissions and ownership are maintained for `/workspaces` # Impact These changes improve our Docker image by: - Reducing image size and improving build efficiency - Enhancing security scanning capabilities - Providing more flexible deployment options through manual triggers - Ensuring consistent automated builds through cron scheduling # Reviewer Notes Please pay special attention to: - The base image change and its impact on existing workflows - Security scanning configuration - Workflow trigger modifications Reviewed-on: #1 Co-authored-by: Guiillaume Hemmen <guillaume@van-hemmen.com> Co-committed-by: Guiillaume Hemmen <guillaume@van-hemmen.com>
2025-06-25 17:26:37 +00:00 · 2025-06-25 17:26:37 +00:00 · 0bd84540a6
commit 0bd84540a6
parent 6095ba1cac
4 changed files with 68 additions and 44 deletions
--- a/.forgejo/workflows/docker-dev.yaml
+++ b/.forgejo/workflows/docker-dev.yaml
@ -2,6 +2,7 @@ on:
  push:
    branches-ignore:
      - 'master'
+  workflow_dispatch:
 jobs:
  docker-dev:
    runs-on: docker
--- a/.forgejo/workflows/docker-master.yaml
+++ b/.forgejo/workflows/docker-master.yaml
@ -2,6 +2,9 @@ on:
  push:
    branches:
      - 'master'
+  schedule:
+    - cron: '0 0 * * *'
+  workflow_dispatch:
 jobs:
  docker-master:
    runs-on: docker
--- a/.forgejo/workflows/docker-pr.yaml
+++ b/.forgejo/workflows/docker-pr.yaml
@ -1,5 +1,6 @@
 on:
  pull_request:
+  workflow_dispatch:

 jobs:
  docker-pr:
--- a/107
+++ b/107
@ -1,55 +1,74 @@
 FROM debian:12

+# Metadata
 LABEL maintainer="guillaume@van-hemmen.com"

+# Build arguments
 ARG ARG_TZ="Europe/Paris"
 ARG ARG_NODE_MAJOR=22
+ARG GITIGNORE_URL="https://www.toptal.com/developers/gitignore/api/linux,jetbrains,visualstudio,visualstudiocode"

-RUN ln -snf /usr/share/zoneinfo/$ARG_TZ /etc/localtime && echo $ARG_TZ > /etc/timezone && \
-    apt-get update && apt-get install -y ca-certificates curl gnupg && \
-    mkdir -p /etc/apt/keyrings && \
-    curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg && \
-    echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_${ARG_NODE_MAJOR}.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list && \
-    apt-get update && apt-get install -y nodejs sudo && \
+# System configuration and timezone setup
+RUN ln -snf /usr/share/zoneinfo/$ARG_TZ /etc/localtime && \
+    echo $ARG_TZ > /etc/timezone
+
+# Install system packages in a single RUN to reduce layers
+# Split into logical groups for better readability
+RUN apt-get update && \
+    apt-get upgrade -y && \
    apt-get install -y \
-                  ca-certificates \
-                  fonts-liberation \
-                  libappindicator3-1 \
-                  libasound2 \
-                  libatk-bridge2.0-0 \
-                  libatk1.0-0 \
-                  libc6 \
-                  libcairo2 \
-                  libcups2 \
-                  libdbus-1-3 \
-                  libexpat1 \
-                  libfontconfig1 \
-                  libgbm1 \
-                  libgcc1 \
-                  libglib2.0-0 \
-                  libgtk-3-0 \
-                  libnspr4 \
-                  libnss3 \
-                  libpango-1.0-0 \
-                  libpangocairo-1.0-0 \
-                  libstdc++6 \
-                  libx11-6 \
-                  libx11-xcb1 \
-                  libxcb1 \
-                  libxcomposite1 \
-                  libxcursor1 \
-                  libxdamage1 \
-                  libxext6 \
-                  libxfixes3 \
-                  libxi6 \
-                  libxrandr2 \
-                  libxrender1 \
-                  libxss1 \
-                  libxtst6 \
-                  lsb-release \
-                  wget \
-                  jq
+    # Development tools
+    build-essential \
+    git \
+    python3 \
+    # System utilities
+    ca-certificates \
+    curl \
+    gnupg2 \
+    procps \
+    sudo \
+    unzip \
+    wget \
+    nano \
+    jq && \
+    # Clean up apt cache to reduce image size
+    rm -rf /var/lib/apt/lists/*

-RUN npm install -g yarn
+# User setup and security configuration
+# Create non-root user 'coder' with sudo privileges
+RUN useradd -m -s /bin/bash -G sudo coder && \
+    echo "coder ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers.d/coder

+# Configure shell environment and git global configuration
+RUN echo "PS1='🐳 \[\033[1;36m\] \[\033[1;34m\]\W\[\033[0;35m\] \[\033[1;36m\]# \[\033[0m\]'" > /home/coder/.bashrc && \
+    mkdir -p /workspaces && \
+    chown coder:coder /home/coder/.bashrc && \
+    chown -R coder:coder /workspaces && \
+    # Set up global gitignore
+    mkdir -p /home/coder/gitignore && \
+    curl -sL ${GITIGNORE_URL} -o /home/coder/global.gitignore && \
+    git config --system core.excludesfile /home/coder/global.gitignore
+
+# Run trivy to scan the system. Exit code is set to 0 as 1 would never allow to pass the scan due to debian known vulns
+RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin \
+       && trivy filesystem --exit-code 0 --no-progress / \
+       && rm -rf /usr/local/bin/trivy
+
+# Switch to non-root user
+USER coder
+
+# Configure bash environment
+ENV BASH_ENV /home/coder/.bash_env
+RUN touch "${BASH_ENV}" && \
+    echo '. "${BASH_ENV}"' >> ~/.bashrc
+
+# Install Node.js using NVM
+RUN curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | PROFILE="${BASH_ENV}" bash && \
+    . $BASH_ENV && \
+    nvm install ${ARG_NODE_MAJOR} && \
+    nvm alias default ${ARG_NODE_MAJOR} && \
+    nvm use ${ARG_NODE_MAJOR} && \
+    npm i -g yarn patch-package
+
+# Install Firebase CLI
 RUN curl -sL firebase.tools | bash