Build multi-platform images

Refactor GitHub Actions workflow for build
Run Dockle and Trivy, upload sarif reports to GitHub
Refactor Dockerfiles based on best practices

src/node/addon-jackett/.dockerignore

@@ -1,3 +1,6 @@
 **/node_modules
 **/npm-debug.log
-**/.env
+**/.env
+.eslint*
+README.md
+Dockerfile

src/node/addon-jackett/Dockerfile

@@ -24,6 +24,12 @@ ENV NODE_ENV production
 COPY --from=builder /app ./
 RUN npm prune --omit=dev
 
+# CIS-DI-0001
+RUN addgroup -S addon-jackett && adduser -S -G addon-jackett addon-jackett
+USER addon-jackett
+
 EXPOSE 7001
 
-ENTRYPOINT [ "pm2-runtime", "start", "ecosystem.config.cjs"]
+ENTRYPOINT [ "pm2-runtime", "start", "ecosystem.config.cjs"]
+HEALTHCHECK --interval=30s --timeout=30s --start-period=5s --retries=3 \
+    CMD pm2 ping || exit 1

src/node/addon/.dockerignore

@@ -1,3 +1,5 @@
 **/node_modules
 **/npm-debug.log
-**/.env
+**/.env
+.eslint*
+Dockerfile

src/node/addon/Dockerfile

@@ -24,6 +24,12 @@ ENV NODE_ENV production
 COPY --from=builder /app ./
 RUN npm prune --omit=dev
 
+# CIS-DI-0001
+RUN addgroup -S addon && adduser -S -G addon addon
+USER addon
+
 EXPOSE 7000
 
-ENTRYPOINT [ "pm2-runtime", "start", "ecosystem.config.cjs"]
+ENTRYPOINT [ "pm2-runtime", "start", "ecosystem.config.cjs"]
+HEALTHCHECK --interval=30s --timeout=30s --start-period=5s --retries=3 \
+    CMD pm2 ping || exit 1

src/node/consumer/.dockerignore

@@ -12,4 +12,5 @@ helm-charts
 .env
 .editorconfig
 .idea
-coverage*
+coverage*
+.eslint*

src/node/consumer/Dockerfile

@@ -21,6 +21,13 @@ ENV NODE_ENV production
 COPY --from=builder /app ./
 RUN npm prune --omit=dev
 
-EXPOSE 7001
+# CIS-DI-0001
+RUN useradd -d /home/consumer -m -s /bin/bash consumer
+# CIS-DI-0008
+RUN chmod u-s /usr/bin/wall /usr/bin/expiry /usr/bin/chage /usr/bin/passwd /usr/bin/gpasswd /usr/bin/chsh /usr/bin/newgrp /usr/bin/chfn /sbin/unix_chkpwd /bin/su /bin/mount /bin/umount /usr/bin/chage /usr/bin/expiry /usr/bin/wall
+USER consumer
 
-ENTRYPOINT [ "node", "dist/index.cjs" ]
+EXPOSE 7001
+ENTRYPOINT [ "node", "dist/index.cjs" ]
+HEALTHCHECK --interval=30s --timeout=30s --start-period=5s --retries=3 \
+    CMD pgrep -x node > /dev/null || exit 1

src/producer/Dockerfile

@@ -1,10 +1,17 @@
-FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build-env
+FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:8.0 AS build
+
+ARG TARGETARCH
 WORKDIR /App
 COPY . ./
-RUN dotnet restore
-RUN dotnet publish -c Release -o out
+RUN dotnet restore -a $TARGETARCH
+RUN dotnet publish -c Release --no-restore -o out -a $TARGETARCH
+
+FROM mcr.microsoft.com/dotnet/aspnet:8.0-alpine
 
-FROM mcr.microsoft.com/dotnet/aspnet:8.0
 WORKDIR /App
-COPY --from=build-env /App/out .
-ENTRYPOINT ["dotnet", "Producer.dll"]
+COPY --from=build /App/out .
+RUN addgroup -S producer && adduser -S -G producer producer
+USER producer
+HEALTHCHECK --interval=30s --timeout=30s --start-period=5s --retries=3 \
+  CMD pgrep -f dotnet || exit 1
+ENTRYPOINT ["dotnet", "Producer.dll"]