rewrite Dockerfile to use nginx unprivilege

Dockerfile

@@ -1,77 +1,22 @@
 FROM node:12-alpine as builder
 
-ENV WORKDIR /home/app
-WORKDIR $WORKDIR
+WORKDIR /app
 
-RUN apk update && apk add git yarn
+RUN apk add --no-cache git
 
-COPY package.json .
-COPY yarn.lock .
-
-RUN yarn install --network-timeout 1000000
+COPY package.json yarn.lock .
+RUN yarn install
 
 COPY . .
 
-ARG VUE_APP_API_BASE_URL
-ARG VUE_APP_BOTHUB_NLP_BASE_URL
-ARG VUE_APP_BOTHUB_WEBAPP_BASE_URL
-ARG VUE_APP_SUPPORTED_LANGUAGES
-ARG VUE_APP_MAILCHIMP_LOGIN
-ARG VUE_APP_MAILCHIMP_DATACENTER
-ARG VUE_APP_MAILCHIMP_USER_ID
-ARG VUE_APP_MAILCHIMP_LIST_ID
-ARG VUE_APP_VERSION_ENABLED
-ARG VUE_APP_BOTHUB_WEBAPP_USE_SENTRY
-ARG VUE_APP_BOTHUB_WEBAPP_SENTRY
-ARG VUE_APP_BOTHUB_WEBAPP_USE_HOTJAR
-ARG VUE_APP_BOTHUB_WEBAPP_HOTJAR_ID
-ARG VUE_APP_BOTHUB_WEBAPP_LIGHTHOUSE_KEY
-ARG VUE_APP_BOTHUB_WEBAPP_LIGHTHOUSE_ALGORITHM_ARTICLE_ID
-ARG VUE_APP_BOTHUB_WEBAPP_PAYMENT_ENABLED
-ARG VUE_APP_BOTHUB_WEBAPP_TUTORIAL_ENABLED
-ARG VUE_APP_HELPHERO_ID
-ARG VUE_APP_HELPHERO_TOUR
-ARG VUE_APP_QA_FLOW_CHANNEL
-ARG VUE_APP_LOGROCKET_ID
-ARG VUE_APP_LOGROCKET_PARENT_DOMAIN
-ARG SENTRY_ENVIRONMENT
-
-ENV VUE_APP_API_BASE_URL "${VUE_APP_API_BASE_URL}"
-ENV VUE_APP_BOTHUB_NLP_BASE_URL "${VUE_APP_BOTHUB_NLP_BASE_URL}"
-ENV VUE_APP_BOTHUB_WEBAPP_BASE_URL "${VUE_APP_BOTHUB_WEBAPP_BASE_URL}"
-ENV VUE_APP_SUPPORTED_LANGUAGES "${VUE_APP_SUPPORTED_LANGUAGES}"
-ENV VUE_APP_MAILCHIMP_LOGIN "${VUE_APP_MAILCHIMP_LOGIN}"
-ENV VUE_APP_MAILCHIMP_DATACENTER "${VUE_APP_MAILCHIMP_DATACENTER}"
-ENV VUE_APP_MAILCHIMP_USER_ID "${VUE_APP_MAILCHIMP_USER_ID}"
-ENV VUE_APP_MAILCHIMP_LIST_ID "${VUE_APP_MAILCHIMP_LIST_ID}"
-ENV VUE_APP_VERSION_ENABLED "${VUE_APP_VERSION_ENABLED}"
-ENV VUE_APP_BOTHUB_WEBAPP_USE_SENTRY "${VUE_APP_BOTHUB_WEBAPP_USE_SENTRY}"
-ENV VUE_APP_BOTHUB_WEBAPP_SENTRY "${VUE_APP_BOTHUB_WEBAPP_SENTRY}"
-ENV VUE_APP_BOTHUB_WEBAPP_USE_HOTJAR "${VUE_APP_BOTHUB_WEBAPP_USE_HOTJAR}"
-ENV VUE_APP_BOTHUB_WEBAPP_HOTJAR_ID "${VUE_APP_BOTHUB_WEBAPP_HOTJAR_ID}"
-ENV VUE_APP_BOTHUB_WEBAPP_LIGHTHOUSE_KEY "${VUE_APP_BOTHUB_WEBAPP_LIGHTHOUSE_KEY}"
-ENV VUE_APP_BOTHUB_WEBAPP_LIGHTHOUSE_ALGORITHM_ARTICLE_ID "${VUE_APP_BOTHUB_WEBAPP_LIGHTHOUSE_ALGORITHM_ARTICLE_ID}"
-ENV VUE_APP_BOTHUB_WEBAPP_PAYMENT_ENABLED "${VUE_APP_BOTHUB_WEBAPP_PAYMENT_ENABLED}"
-ENV VUE_APP_BOTHUB_WEBAPP_TUTORIAL_ENABLED "${VUE_APP_BOTHUB_WEBAPP_TUTORIAL_ENABLED}"
-ENV VUE_APP_HELPHERO_ID "${VUE_APP_HELPHERO_ID}"
-ENV VUE_APP_HELPHERO_TOUR "${VUE_APP_HELPHERO_TOUR}"
-ENV VUE_APP_QA_FLOW_CHANNEL "${VUE_APP_QA_FLOW_CHANNEL}"
-ENV VUE_APP_LOGROCKET_ID "${VUE_APP_LOGROCKET_ID}"
-ENV VUE_APP_LOGROCKET_PARENT_DOMAIN "${VUE_APP_LOGROCKET_PARENT_DOMAIN}"
-ENV SENTRY_ENVIRONMENT "${SENTRY_ENVIRONMENT}"
-
 RUN yarn build
 
-FROM nginx
-
-COPY nginx.conf /etc/nginx/nginx.conf
-COPY --from=builder /home/app/dist /usr/share/nginx/html/bothub-webapp
+FROM nginxinc/nginx-unprivileged:1.25
 
+COPY --chown=nginx:root nginx.conf /etc/nginx/nginx.conf
+COPY --from=builder --chown=nginx:nginx /app/dist /app/config.js.tmpl /usr/share/nginx/html/bothub-webapp
 COPY docker-entrypoint.sh /
 
+EXPOSE 8080
 ENTRYPOINT ["/docker-entrypoint.sh"]
-
 CMD ["nginx", "-g", "daemon off;"]
-
-COPY config.js.tmpl /usr/share/nginx/html/bothub-webapp/
-

docker-compose.yml

@@ -6,7 +6,7 @@ services:
     build:
       context: .
       dockerfile: Dockerfile
-      args:
+      environment:
         - VUE_APP_API_BASE_URL=${VUE_APP_API_BASE_URL:-http://localhost:8000}
         - VUE_APP_BOTHUB_NLP_BASE_URL=${VUE_APP_BOTHUB_NLP_BASE_URL:-http://localhost:2657/}
         - VUE_APP_BOTHUB_WEBAPP_BASE_URL=${VUE_APP_BOTHUB_WEBAPP_BASE_URL:-http://localhost:8080/}

docker-entrypoint.sh

@@ -4,4 +4,4 @@ if [ ! -f /usr/share/nginx/html/bothub-webapp/config.js ] ; then
 	envsubst < /usr/share/nginx/html/bothub-webapp/config.js.tmpl > /usr/share/nginx/html/bothub-webapp/config.js
 fi
 
-exec "$@"
+exec "$@"

nginx.conf

@@ -1,25 +1,30 @@
-user                            nginx;
 worker_processes                1;
 
-error_log                       /var/log/nginx/error.log warn;
-pid                             /var/run/nginx.pid;
+error_log                       /dev/stdout warn;
+pid                             /tmp/nginx.pid;
 
 events {
   worker_connections            1024;
 }
 
 http {
+  proxy_temp_path /tmp/proxy_temp;
+  client_body_temp_path /tmp/client_temp;
+  fastcgi_temp_path /tmp/fastcgi_temp;
+  uwsgi_temp_path /tmp/uwsgi_temp;
+  scgi_temp_path /tmp/scgi_temp;
+
   include                       /etc/nginx/mime.types;
   default_type                  application/octet-stream;
   charset                       UTF-8;
   sendfile                      on;
   log_format                    main '$remote_addr - $remote_user [$time_local] "$request" '
                                      '$status $body_bytes_sent "$http_referer" '
                                      '"$http_user_agent" "$http_x_forwarded_for"';
-  access_log                    /var/log/nginx/access.log main;
+  access_log                    /dev/stdout main;
 
   server {
-    listen                      80;
+    listen                      8080;
     server_name                 localhost;
     client_max_body_size        32m;
 
@@ -44,4 +49,4 @@ http {
       root                      /var/lib/nginx/html;
     }
   }
-}
+}