Merge pull request #241 from consideRatio/docker-image-from-package-lock

Docker image: use package-lock.json and only include relevant parts

Author: minrk

.dockerignore

@@ -0,0 +1,9 @@
+# Ignore everything...
+*
+# ... except:
+!bin/
+!lib/
+!chp-docker-entrypoint
+!index.js
+!package*.json
+!LICENSE

Dockerfile

@@ -6,14 +6,14 @@ LABEL maintainer="Jupyter Project <[email protected]>"
 # Useful tools for debugging
 RUN apk add --no-cache jq curl
 
+# Copy relevant (see .dockerignore)
 RUN mkdir -p /srv/configurable-http-proxy
-COPY . /srv/configurable-http-proxy
+COPY . /srv/configurable-http-proxy/
 WORKDIR /srv/configurable-http-proxy
 
-# Install configurable-http-proxy, then automatically install compatible updates
-# to vulnerable dependencies, and finally uninstall npm which isn't needed.
-RUN npm install -g --production \
- && npm audit fix \
+# Install configurable-http-proxy according to package-lock.json (ci) without
+# devDepdendencies (--production), then uninstall npm which isn't needed.
+RUN npm ci --production \
  && npm uninstall -g npm
 
 # Switch from the root user to the nobody user
@@ -24,4 +24,6 @@ USER 65534
 EXPOSE 8000
 EXPOSE 8001
 
+# Put configurable-http-proxy on path for chp-docker-entrypoint
+ENV PATH=/srv/configurable-http-proxy/bin:$PATH
 ENTRYPOINT ["/srv/configurable-http-proxy/chp-docker-entrypoint"]