Skip to content

DOCKER_CI_IMPROVEMENTS.md

Latest commit

 

History

History
140 lines (98 loc) · 4.59 KB

DOCKER_CI_IMPROVEMENTS.md

File metadata and controls

140 lines (98 loc) · 4.59 KB

Docker and CI/CD Improvements Summary

This document summarizes the improvements made to the Dockerfile and CI/CD pipeline for the IPTV Proxy project.

Dockerfile Improvements

Before

  • Single-stage build
  • Installed both dev and production dependencies
  • Built admin UI inside the Docker image
  • No security hardening
  • No health checks
  • Used npm run serve which adds overhead

After - Best Practices Applied

1. Multi-Stage Build

  • Stage 1 (deps): Builds production dependencies only using npm ci --omit=dev
  • Stage 2 (final): Copies only production dependencies and application code
  • Benefit: Reduces final image size by excluding build tools and dev dependencies

2. Security Improvements

  • Non-root user: Application runs as appuser (UID 1001) instead of root
  • Proper permissions: /config and /usr/src/app directories owned by appuser
  • OCI Labels: Added standard container metadata labels for source, description, and license

3. Health Checks

  • Added Docker HEALTHCHECK instruction that polls /health endpoint every 30 seconds
  • Added new /health endpoint in server/health.js that returns { status: 'ok' }
  • Allows orchestrators (Docker, Kubernetes) to monitor container health

4. Build Optimization

  • Direct execution with node index.js instead of npm run serve (eliminates npm overhead)
  • Proper layer caching by copying package files before source code
  • Admin UI built in CI/CD pipeline and copied to container (faster builds, smaller images)

5. .dockerignore

  • Created .dockerignore to exclude unnecessary files from build context:
    • .git/, .github/
    • node_modules/ (installed fresh in container)
    • Development files (.vscode, *.log)
    • Config and data directories (mounted at runtime)

CI/CD Pipeline Improvements

Before

  • Basic workflow with only build and push
  • No linting or security checks
  • Limited caching

After - Enhanced Automation

1. New Jobs Structure

lint-and-security → test → build-admin → docker-build-push

2. Lint and Security Checks Job

  • Runs npm audit on root dependencies
  • Runs npm audit on admin dependencies
  • Uses continue-on-error: true to not block builds on minor vulnerabilities
  • Helps identify security issues early

3. Test Job

  • Placeholder for running tests (npm test)
  • Ready for when test suite is implemented
  • Ensures tests run before Docker builds

4. Enhanced Build Admin Job

  • Uses npm caching via cache: 'npm' and cache-dependency-path
  • Depends on lint-and-security job passing
  • Faster builds through GitHub Actions cache

5. Docker Build Improvements

  • Added Trivy vulnerability scanning for container images (PRs only)
  • Results uploaded to GitHub Security tab (SARIF format)
  • Proper job dependencies ensure quality gates
  • Added security-events: write permission for SARIF uploads

6. Caching Optimizations

  • GitHub Actions cache for npm dependencies
  • Docker layer caching with cache-from: type=gha and cache-to: type=gha,mode=max
  • Significantly faster subsequent builds

Image Size Comparison

Estimated Savings

  • Before: ~450-500MB (with dev dependencies and build tools)
  • After: ~200-250MB (production dependencies only)
  • Reduction: ~40-50% smaller images

Security Benefits

  1. Non-root execution: Reduced attack surface
  2. Dependency scanning: Early detection of vulnerabilities
  3. Container scanning: Image-level vulnerability detection
  4. Health monitoring: Automatic restart of unhealthy containers
  5. Minimal attack surface: Only production dependencies included

Best Practices Followed

✅ Multi-stage builds for smaller images ✅ .dockerignore to optimize build context ✅ Non-root user for security ✅ Health checks for reliability ✅ OCI standard labels for metadata ✅ Dependency caching for faster builds ✅ Security scanning (npm audit + Trivy) ✅ Proper layer ordering for cache efficiency ✅ Specific Node.js version (node:20-alpine)

CI/CD Workflow Features

  • On Push to main: Full pipeline with image push to GHCR
  • On Pull Request: Full pipeline without image push (validation only)
  • On Tags (v*): Creates versioned releases with semver tags
  • Multi-platform: Builds for linux/amd64 and linux/arm64 (on push)

Next Steps (Future Enhancements)

  1. Add actual test suite and remove placeholder
  2. Consider adding linting rules (ESLint) and enforce in CI
  3. Add code coverage reporting
  4. Consider adding integration tests for Docker image
  5. Add automated dependency updates (Dependabot/Renovate)
  6. Consider adding performance benchmarks