improve Dockerfile

compose file should maybe make it run as readonly container, also dependabot for the dockjer tags would be a good idea

Signed-off-by: Zoey <[email protected]>

Dockerfile

@@ -1,27 +1,25 @@
+# syntax=docker/dockerfile:latest
 # SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
-ARG NODE_VERSION=20
-
-FROM node:${NODE_VERSION}-alpine
-
-ENV NODE_ENV production
-
-WORKDIR /usr/src/app
-
-RUN --mount=type=bind,source=package.json,target=package.json \
-    --mount=type=bind,source=package-lock.json,target=package-lock.json \
-    --mount=type=cache,target=/root/.npm \
-    npm ci --omit=dev
-
-# Run the application as a non-root user.
-USER node
-
-# Copy the rest of the source files into the image.
-COPY . .
-
-# Expose the port that the application listens on.
+FROM node:20.17.0-alpine3.20 AS build
+SHELL ["/bin/ash", "-eo", "pipefail", "-c"]
+ARG NODE_ENV=production
+COPY . /app
+WORKDIR /app
+RUN apk upgrade --no-cache -a && \
+    apk add --no-cache ca-certificates && \
+    npm install --global clean-modules && \
+    npm clean-install && \
+    clean-modules --yes && \
+    npm cache clean --force
+
+FROM node:20.17.0-alpine3.20
+COPY --from=build --chown=nobody:nobody /app /app
+WORKDIR /app
+RUN apk upgrade --no-cache -a && \
+    apk add --no-cache ca-certificates tzdata netcat-openbsd
+USER nobody
 EXPOSE 3002
-
-# Run the application.
-CMD node websocket_server/server.js
+ENTRYPOINT ["npm", "run", "server:start"]
+HEALTHCHECK CMD nc -z 127.0.0.1 3002 || exit 1