From dccaaf0d138c711de101aa4ba0141562aa1e3f0d Mon Sep 17 00:00:00 2001
From: Nullnet Services Administrator <admin@nullnet.services>
Date: Fri, 17 Mar 2023 12:58:22 -0500
Subject: [PATCH 1/2] move to a distroless image; less bloat and more secure

---
 Dockerfile | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 58b168c..2c50f31 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,10 @@
-FROM node:16-alpine
+FROM node:16-alpine AS build
 WORKDIR /wikiless
 COPY . /wikiless
 RUN npm install --no-optional
-COPY config.js.template config.js
-CMD npm start
 
+FROM gcr.io/distroless/nodejs:16
+COPY --from=build /wikiless /wikiless
+WORKDIR /wikiless
+COPY config.js.template config.js
+CMD ["src/wikiless.js"]
\ No newline at end of file

From 44316a7522dcef0de43fb928ca3e1dc5cf3ec577 Mon Sep 17 00:00:00 2001
From: Nullnet Services Administrator <admin@nullnet.services>
Date: Fri, 17 Mar 2023 13:03:07 -0500
Subject: [PATCH 2/2] harden docker-compose.yml

---
 docker-compose.yml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/docker-compose.yml b/docker-compose.yml
index b2c5fe0..ca1c3ed 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,5 +1,6 @@
 version: "3.9"
 services:
+
   web:
     image: ghcr.io/metastem/wikiless:latest
     environment:
@@ -9,5 +10,28 @@ services:
       REDIS_URL: redis://redis
     ports:
       - 8080:8080
+    user: 65534:65534
+    read_only: true
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    networks:
+      - wikiless
+
   redis:
     image: "redis:alpine"
+    container_name: redis
+    user: nobody
+    read_only: true
+    tmpfs:
+      - /data:size=10M,mode=0770,uid=65534,gid=65534,noexec,nosuid,nodev
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    networks:
+      - wikiless
+
+networks:
+  wikiless:
\ No newline at end of file