From 7a7dfe959b184c669fe0f7bd8bbe51998e5ba45d Mon Sep 17 00:00:00 2001 From: dervoeti Date: Mon, 7 Sep 2026 09:14:01 +0000 Subject: [PATCH] fix(docker): Exclude devOptional build tooling from prod deps and SBOM --- docker/Dockerfile | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index 48da636d..2cb5a9dd 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -74,17 +74,33 @@ WORKDIR /build COPY package.json package-lock.json .npmrc ./ -# Install only production dependencies; --ignore-scripts skips the prepare script -# (which would fail because antlr-ng is a devDependency and not available here) -RUN --mount=type=cache,target=/root/.npm npm ci --omit=dev --ignore-scripts +# Install only production dependencies. +# +# --ignore-scripts skips the prepare script (which would fail because antlr-ng +# is a devDependency and not available here). +# +# --omit=optional is required on top of --omit=dev: better-auth declares svelte, +# @sveltejs/kit and vitest as optional peerDependencies. Because we also list +# them in devDependencies, npm marks them (and their trees: vite, rollup, +# typescript, ...) as "devOptional" in package-lock.json, and --omit=dev alone +# keeps devOptional entries. That pulled build tooling into the runtime image +# and into the generated SBOM. +# +# The adapter-node output bundles its dependencies, so none of the omitted +# packages are needed at runtime. +RUN --mount=type=cache,target=/root/.npm \ + npm ci --omit=dev --omit=optional --ignore-scripts # # SBOM stage - generate CycloneDX from the clean prod-only dependency tree # FROM prod-deps AS sbom -RUN npm ls --omit=dev && \ - npx @cyclonedx/cyclonedx-npm --omit dev --output-file /build/cockpit.cdx.json +# The omit flags must match those of the prod-deps stage so that the SBOM +# describes the dependency tree that is actually shipped. +RUN npm ls --omit=dev --omit=optional && \ + npx @cyclonedx/cyclonedx-npm --omit dev --omit optional \ + --output-file /build/cockpit.cdx.json # # Production stage - minimal runtime image