Dockerfile

FROM node:24.22.1-trixie-slim@sha256:43b9ba1142b8dcf33fa8f922ca1be85714adc444e0586c7cf7726daaeabc1bea AS build

LABEL \
    mitre.name=cveawg \
    mitre.project=cveawg

# Run an optional pre-flight script for host-dependent requirements such as
# corporate CA certificates before package installation performs network I/O.
ARG CVE_PREFLIGHT
RUN /bin/sh -c "${CVE_PREFLIGHT:-exit 0}"

# Python and build essentials are required when argon2 builds from source.
# Git supports git-based dependencies; wget downloads the RDS CA bundle.
RUN apt-get update \
    && apt-get install --yes --no-install-recommends python3 make g++ ca-certificates wget git \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app
# Amazon DocumentDB presents certificates chained to AWS's RDS global CA.
RUN mkdir -p /app/certs \
    && wget -q -O /app/certs/global-bundle.pem https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem

COPY package.json package-lock.json ./
RUN npm ci

COPY src ./src
COPY schemas ./schemas
COPY api-docs ./api-docs
COPY config ./config
COPY docker/default.json-docker ./config/default.json
RUN for environment in development staging integration production test; do \
      printf '{}\n' > "./config/${environment}.json"; \
    done

# Generate the OpenAPI artifact while build-only dependencies are available,
# then remove them before copying node_modules into the runtime image.
RUN node src/swagger.js \
    && npm prune --omit=dev \
    && npm cache clean --force

FROM gcr.io/distroless/nodejs24-debian13:nonroot@sha256:cb606325b7ec4af55462cb0b424a53b452a5b4a894ffe841fcf1048d216fb9f8 AS runtime

LABEL \
    mitre.name=cveawg \
    mitre.project=cveawg

ENV NODE_ENV=production

WORKDIR /app

# Preserve any custom CA certificates installed by CVE_PREFLIGHT in the build
# stage. The application otherwise runs with a read-only application tree.
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=build --chown=65532:65532 /app/certs ./certs
COPY --from=build --chown=65532:65532 /app/node_modules ./node_modules
COPY --from=build --chown=65532:65532 /app/package.json ./package.json
COPY --from=build --chown=65532:65532 /app/src ./src
COPY --from=build --chown=65532:65532 /app/schemas ./schemas
COPY --from=build --chown=65532:65532 /app/api-docs ./api-docs
COPY --from=build --chown=65532:65532 /app/config ./config

EXPOSE 3000
CMD ["src/scripts/start.js"]