Dockerfile.dev

# Use specific version for reproducibility and security updates
FROM node:22.15.0-alpine

# Install security updates, build dependencies, and dumb-init for signal handling
RUN apk update && \
    apk upgrade && \
    apk add --no-cache \
        dumb-init \
        python3 \
        make \
        g++ \
        curl \
        ca-certificates && \
    rm -rf /var/cache/apk/*

# Create non-root user with limited permissions
RUN addgroup -g 1001 -S nodejs && \
    adduser -S nodejs -u 1001

# Set working directory
WORKDIR /app

# Copy package files for dependency installation
COPY package.json package-lock.json ./

# Install dependencies with --ignore-scripts to prevent compromised packages
# from executing arbitrary code during install. Post-install scripts that are
# legitimately needed (e.g. native addon builds) must be explicitly run after.
RUN npm pkg delete scripts.prepare && \
    npm ci --ignore-scripts && \
    npm cache clean --force && \
    rm -rf /root/.npm /root/.cache

# Rebuild native addons that need compilation (safe — runs node-gyp, not package scripts)
RUN npm rebuild

# Copy entrypoint script and source code
COPY --chown=nodejs:nodejs . .

# Switch to non-root user
USER nodejs

# Set secure environment variables
ENV NODE_ENV=development \
    NPM_CONFIG_AUDIT=true \
    NPM_CONFIG_FUND=false \
    NPM_CONFIG_AUDIT_LEVEL=moderate

# Expose port
EXPOSE 9999

# Use dumb-init for proper signal handling — prevents zombie processes
# and ensures clean shutdown even if a dependency spawns child processes
ENTRYPOINT ["dumb-init", "--"]
CMD ["sh", "docker-entrypoint.sh"]