ogrechkoandClaude Sonnet 5
2cb2bc0729
next dev bound to 0.0.0.0:3000 with the host source dir bind-mounted rw was the entry point malware kept getting dropped through (see prior commit). Now builds and runs `next start`; the bind mount is gone so a compromised container can no longer write onto host disk. Also bumps next to 15.1.11, patching CVE-2025-66478 (critical RCE via the RSC Next-Action header) and the follow-up CVE-2025-67779/55184/ 55183 batch — the installed 15.1.6 was vulnerable to all of them and is the likely actual initial-access vector. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Gh2UXUQUVBWroWEnn1FLFG
19 lines
509 B
Docker
19 lines
509 B
Docker
FROM node:22-bookworm-slim
|
|
|
|
WORKDIR /app
|
|
|
|
# registry.npmjs.org resolves to Cloudflare's IPv6-only records here, and
|
|
# Docker's default bridge network has flaky IPv6 egress — Node's Happy
|
|
# Eyeballs then hangs on IPv6 before timing out instead of falling back to
|
|
# IPv4 quickly, causing intermittent ETIMEDOUT mid-install.
|
|
ENV NODE_OPTIONS=--dns-result-order=ipv4first
|
|
|
|
COPY package.json package-lock.json* ./
|
|
RUN npm install
|
|
|
|
COPY . .
|
|
RUN npm run build
|
|
|
|
CMD ["npm", "start", "--", "--hostname", "0.0.0.0"]
|
|
|