mirror of
https://github.com/vectorize-io/hindsight.git
synced 2026-09-14 19:31:49 +08:00
Nicolò Boschi
d9b99575a4
The standalone stage is FROM python:3.11-slim because it runs the Python API, but it also runs the control plane - a pre-built Next standalone bundle launched with `node server.js` - so it needs a Node runtime in a Python base image. That came from NodeSource: a shell script downloaded from a third-party host and executed as root at build time to install their signing key and apt repo. cp-builder is already node:24-slim and has the binary, so copy it instead. This removes 28 packages from the runtime image, none of which anything runs: the entire GnuPG suite and its dependencies (used only to verify NodeSource's repo key at build time) and a second system Python - python3.13, inside a python:3.11 image - plus nodejs itself. Trivy 0.74.0 HIGH+CRITICAL goes from 3C/82H to 3C/60H, 22 High removed, no new findings. It also removes a `curl | bash` from a third-party host at build time and makes the stage reproducible: the remote script and the repo behind it could move under a fixed Dockerfile. npm never arrives now, so the removal by path - and the `[ -e ]` guard that existed to catch a base bump moving that path - goes away with it. curl stays for now: start-all.sh still probes the API health endpoint with it. That is #4198, which needs a probe that matches `curl -sf` exactly and is deliberately not bundled here. Closes #4196