deploy-stack 0.9.9 → 0.9.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deploy-stack",
-  "version": "0.9.9",
+  "version": "0.9.11",
   "description": "Provision production-ready AWS infrastructure and CI/CD pipelines in seconds.",
   "type": "module",
   "bin": {

package/templates/docker/django.Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.12-slim
+FROM python:3.12-alpine
 
 # Prevent Python from writing .pyc files and buffer stdout for cleaner logs
 ENV PYTHONDONTWRITEBYTECODE=1
@@ -6,24 +6,26 @@ ENV PYTHONUNBUFFERED=1
 
 WORKDIR /app
 
-# Upgrade Debian OS packages to patch system-level CVEs (like python3-setuptools)
-RUN apt-get update && apt-get upgrade -y && \
-    apt-get install -y --no-install-recommends gcc libpq-dev && \
-    rm -rf /var/lib/apt/lists/*
+# Create unprivileged user (Alpine syntax)
+RUN addgroup -g 1001 appgroup && \
+    adduser -u 1001 -G appgroup -s /bin/sh -D appuser
 
-# Create unprivileged user
-RUN groupadd -g 1001 appgroup && \
-    useradd -u 1001 -g appgroup -s /bin/sh -m appuser
+# Install runtime libraries and temporary build tools
+RUN apk update && \
+    apk add --no-cache libpq && \
+    apk add --no-cache --virtual .build-deps gcc musl-dev postgresql-dev
 
 COPY requirements.txt .
 
-# Upgrade core pip tools and purge downloaded caches to resolve ghost CVEs
+# Upgrade pip, install dependencies, clear caches, and NUKE package managers
 RUN pip install --no-cache-dir --upgrade pip setuptools wheel && \
+    pip install --no-cache-dir -r requirements.txt gunicorn && \
+    find / -type d -name "ensurepip" -exec rm -rf {} + || true && \
     rm -rf /root/.cache/pip && \
-    rm -rf /usr/local/lib/python3.12/ensurepip/_bundled
+    pip uninstall -y setuptools wheel pip
 
-# Install dependencies without caching to keep the image size small
-RUN pip install --no-cache-dir -r requirements.txt gunicorn
+# Remove the build tools to shrink the image and reduce attack surface
+RUN apk del .build-deps
 
 # Copy code with explicit ownership
 COPY --chown=appuser:appgroup . .

package/templates/docker/nuxt.Dockerfile

@@ -2,9 +2,16 @@
 FROM node:22-alpine AS builder
 WORKDIR /app
 
+# Install native build tools required to compile C++ Node modules (like better-sqlite3)
+RUN apk update && \
+    apk add --no-cache python3 make g++ sqlite-dev
+
 COPY package.json package-lock.json* ./
 RUN npm ci
 
+# Explicitly install better-sqlite3 to satisfy Nuxt 4 / Nitro dynamic requirements
+RUN npm install better-sqlite3
+
 COPY . .
 RUN npm run build
 
@@ -16,6 +23,17 @@ ENV NODE_ENV=production
 ENV PORT={{PORT}}
 ENV HOSTNAME="0.0.0.0"
 
+# 1. Upgrade Alpine OS packages to clear OpenSSL/crypto CVEs
+# 2. Vaporize Node package managers (npm, yarn, corepack) to clear ghost CVEs
+RUN apk update && apk upgrade --no-cache && \
+    rm -rf /usr/local/lib/node_modules \
+    /usr/local/bin/npm \
+    /usr/local/bin/npx \
+    /usr/local/bin/yarn \
+    /usr/local/bin/yarnpkg \
+    /usr/local/bin/corepack \
+    /opt/yarn-*
+
 # Create an unprivileged user and group
 RUN addgroup -g 1001 -S nodejs && \
     adduser -S nuxtjs -u 1001 -G nodejs

package/templates/docker/python.Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.12-slim
+FROM python:3.12-alpine
 
 # Prevent Python from writing .pyc files and buffer stdout for cleaner logs
 ENV PYTHONDONTWRITEBYTECODE=1
@@ -6,23 +6,26 @@ ENV PYTHONUNBUFFERED=1
 
 WORKDIR /app
 
-# Upgrade Debian OS packages to patch system-level CVEs (like python3-setuptools)
-RUN apt-get update && apt-get upgrade -y && \
-    apt-get install -y --no-install-recommends gcc libpq-dev && \
-    rm -rf /var/lib/apt/lists/*
+# Create a non-root user for security compliance (Alpine syntax)
+RUN addgroup -S appuser && \
+    adduser -S appuser -G appuser -D -s /bin/sh
 
-# Create a non-root user for security compliance
-RUN adduser --disabled-password --gecos '' appuser
+# Install runtime libraries and temporary build tools
+RUN apk update && \
+    apk add --no-cache libpq && \
+    apk add --no-cache --virtual .build-deps gcc musl-dev postgresql-dev
 
 COPY requirements.txt .
 
-# Upgrade core pip tools and purge downloaded caches to resolve ghost CVEs
+# Upgrade pip, install dependencies, clear caches, and NUKE package managers
 RUN pip install --no-cache-dir --upgrade pip setuptools wheel && \
+    pip install --no-cache-dir -r requirements.txt && \
+    find / -type d -name "ensurepip" -exec rm -rf {} + || true && \
     rm -rf /root/.cache/pip && \
-    rm -rf /usr/local/lib/python3.12/ensurepip/_bundled
+    pip uninstall -y setuptools wheel pip
 
-# Install dependencies without caching to keep the image size small
-RUN pip install --no-cache-dir -r requirements.txt
+# Remove the build tools to shrink the image and reduce attack surface
+RUN apk del .build-deps
 
 # Copy with ownership
 COPY --chown=appuser:appuser . .