Security: Replace curl-pipe-bash nodesource install with official Node.js Docker image

[LucasMaupin]

Summary

The frontend Dockerfile installs Node.js by piping a remote shell script directly into bash at image build time:

RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash -

This is a supply-chain attack vector: if the nodesource CDN is compromised, DNS is hijacked, or a TLS MITM is possible in the build environment, an attacker can execute arbitrary code as root inside the Docker build context and embed malicious binaries in the final image.

Affected File

Dockerfile (lines 8–10):

RUN apt-get update
RUN apt-get install -y curl
RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
RUN apt-get install -y nodejs

Recommended Fix

Use a multi-stage Dockerfile (tracked in #640): use an official node:22-alpine image as the build stage, then copy only the compiled static assets into the nginx runtime stage. This eliminates the need to install Node.js into the nginx image entirely.

# Stage 1: Build
FROM node:22-alpine AS builder
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
ARG VITE_BACKEND_URL
ENV VITE_BACKEND_URL=$VITE_BACKEND_URL
RUN npm run build

# Stage 2: Serve
FROM nginx:1.29.0-alpine
COPY --from=builder /app/dist /usr/share/nginx/html
COPY ./nginx/nginx.conf /etc/nginx/conf.d/default.conf
EXPOSE 8080

This approach:

• Removes the curl-pipe-bash install entirely
• Uses only official, integrity-verified Docker base images
• Produces a smaller final image with no build tooling or development dependencies
• Also resolves Security: Refactor frontend Dockerfile to multi-stage build — remove Node.js from runtime image #640 (multi-stage build) and Security: Frontend Dockerfile runs nginx as root — add non-root USER directive #648 (runs as root)

References

• Docker multi-stage builds
• Official Node.js Docker images
• Related: Security: Refactor frontend Dockerfile to multi-stage build — remove Node.js from runtime image #640 (multi-stage Dockerfile refactor), Security: Frontend Dockerfile runs nginx as root — add non-root USER directive #648 (nginx running as root)