From 2cb2bc07298b3ba86e638b70142b0b8175cf595c Mon Sep 17 00:00:00 2001 From: ogrechko Date: Thu, 3 Sep 2026 04:32:29 +0000 Subject: [PATCH] Run frontend in production mode instead of exposed npm run dev MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit next dev bound to 0.0.0.0:3000 with the host source dir bind-mounted rw was the entry point malware kept getting dropped through (see prior commit). Now builds and runs `next start`; the bind mount is gone so a compromised container can no longer write onto host disk. Also bumps next to 15.1.11, patching CVE-2025-66478 (critical RCE via the RSC Next-Action header) and the follow-up CVE-2025-67779/55184/ 55183 batch — the installed 15.1.6 was vulnerable to all of them and is the likely actual initial-access vector. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01Gh2UXUQUVBWroWEnn1FLFG --- docker-compose.yml | 4 ---- frontend/Dockerfile | 9 ++++++++- frontend/package.json | 4 ++-- 3 files changed, 10 insertions(+), 7 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index e54a542..b813f3b 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -34,10 +34,6 @@ services: restart: unless-stopped env_file: - ./frontend/.env.local - volumes: - - ./frontend:/app - - /app/node_modules - - /app/.next ports: - "3000:3000" depends_on: diff --git a/frontend/Dockerfile b/frontend/Dockerfile index 0dbf9aa..2992510 100644 --- a/frontend/Dockerfile +++ b/frontend/Dockerfile @@ -2,10 +2,17 @@ FROM node:22-bookworm-slim WORKDIR /app +# registry.npmjs.org resolves to Cloudflare's IPv6-only records here, and +# Docker's default bridge network has flaky IPv6 egress — Node's Happy +# Eyeballs then hangs on IPv6 before timing out instead of falling back to +# IPv4 quickly, causing intermittent ETIMEDOUT mid-install. +ENV NODE_OPTIONS=--dns-result-order=ipv4first + COPY package.json package-lock.json* ./ RUN npm install COPY . . +RUN npm run build -CMD ["npm", "run", "dev", "--", "--hostname", "0.0.0.0"] +CMD ["npm", "start", "--", "--hostname", "0.0.0.0"] diff --git a/frontend/package.json b/frontend/package.json index 3ffe339..2e9d22e 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -10,7 +10,7 @@ }, "dependencies": { "lucide-react": "^0.469.0", - "next": "15.1.6", + "next": "15.1.11", "react": "19.0.0", "react-dom": "19.0.0" }, @@ -19,7 +19,7 @@ "@types/react": "^19.0.2", "@types/react-dom": "^19.0.2", "eslint": "^9.17.0", - "eslint-config-next": "15.1.6", + "eslint-config-next": "15.1.11", "typescript": "^5.7.2" } }