This lesson's interactive features are locked, please to keep using them

Build Artifacts and Deployment Hygiene

A production container (like a Docker container) should have access to what the app needs to run and not much else. Extra tools and files increase image size and give an attacker more to work with.

Imagine a media app that runs TypeScript directly using Node.js 24. Its Dockerfile might look like this:

FROM node:24-alpine

WORKDIR /app
COPY . .
RUN npm ci

CMD ["npm", "start"]

It copies the entire build context, installs development tooling in the final image, and runs as the default root user. Not great.

A multi-stage build can prepare production dependencies separately, then copy only the required runtime files into the final stage:

FROM node:24-alpine AS dependencies
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev

FROM node:24-alpine AS runtime
WORKDIR /app
COPY --from=dependencies /app/node_modules ./node_modules
COPY package.json ./
COPY src ./src
COPY public ./public
RUN mkdir -p data/uploads data/render-jobs \
  && chown -R node:node data
COPY --chown=node:node data/uploads/sample-poster.webp ./data/uploads/
USER node
CMD ["node", "src/main.ts"]

The exact steps depend on the app, of course. But we shouldn't dump the entire project into production. Explicitly copy only the stuff production needs. The final image is smaller and doesn't include development tools an attacker could use.

Running as a non-root user (node, in this case) limits what a compromised process can do. Of course, the app's user still needs permission to perform its ordinary runtime work.

Assignment

Bearly Secure's production image currently includes the entire project, development tools, and a root process. Replace it with a narrow, multi-stage Node.js 24 image.

Create separate dependency and runtime stages. Keep the direct-TypeScript runtime; don't add a compilation or dist/ step.
In the dependency stage, copy the package JSON files before running npm to install only production dependencies.
In the runtime stage, set the working directory to /app.
Copy only the following directories and files into the runtime stage. Do not use COPY . .:
- any production dependencies
- package.json
- src/
- public/
- the uploaded "Mystery Shack" PDF
Create writable database, log, upload, and bulk-import directories owned by the node user.
Execute the final image as the non-root node user and start src/main.ts directly.
If you have Docker installed, build the image with docker build -t bearly-secure . and confirm docker run --rm bearly-secure id -u prints a nonzero user ID.
If you have Docker installed, run the image with port 3000 published and fake PAWPAL_API_KEY and DOWNLOAD_SIGNING_KEY values. Confirm /health responds successfully, then stop the container.

Run and submit the CLI tests from the project root.