Hardening: multi-stage Docker build + .dockerignore#8
Open
bencao wants to merge 1 commit into
Open
Conversation
[LOW] The previous Dockerfile (FROM nginx + COPY . /usr/share/nginx/html) shipped the entire repo to the nginx web root, exposing raw source (src/), docs, package*.json, *.psd design files, etc., and was also broken because it served un-built ES modules. - Convert Dockerfile to a multi-stage build: stage 1 (node:20-alpine) runs `npm ci && npm run build`; stage 2 (nginx:alpine) copies only the Vite build output (`COPY --from=build /app/dist /usr/share/nginx/html`). - Add .dockerignore excluding node_modules, .git, docs, test, *.psd/*.ai, env files, and Docker files to keep the build context minimal. [INFO] Remove debug-only `window.*` game-object assignments in src/bootstrap.js. They are referenced nowhere else (kick_off runs on the local `game` const) so removal is safe; no security impact, just cleanup. Verification: `npm run build` succeeds (outDir `dist/`), `npm test` 121/121 pass, and `docker build` produces a web root containing only built assets (index.html, assets/, data/, vendor/) with no source/docs/psd. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two low/informational security-hardening improvements for this client-side Vite game.
1. [LOW] Dockerfile shipped the entire repo to the nginx web root
The previous
DockerfilewasFROM nginx+COPY . /usr/share/nginx/html, which served rawsrc/,docs/,package*.json,*.psddesign files, etc. to the public web root — and was also broken, since it served un-built ES modules.Change: converted to a multi-stage build.
node:20-alpine):npm ci && npm run build.nginx:alpine):COPY --from=build /app/dist /usr/share/nginx/html— only the Vite build output (ViteoutDirisdist, confirmed invite.config.js)..dockerignoreexcludingnode_modules,.git,docs,test,*.psd/*.ai, env files, and the Docker files themselves to keep the build context minimal.2. [INFO] Debug
window.*assignments insrc/bootstrap.jsRemoved the debug-only global assignments (
window.game,window.welcome_scene, etc.). They are referenced nowhere else insrc/,test/, orindex.html(verified by grep);kick_off()runs on the localgameconst, so removal is safe. No security impact — this is cleanup, included since it was low-risk.Verification
npm run build(output dir isdist/):npm test: 121/121 passing (11 files).docker buildsucceeds, and the resulting nginx web root contains only built assets (no source/docs/psd):(
50x.htmlis nginx's own default error page from the base image.)🤖 Generated with Claude Code