[PR #4233] [MERGED] refactor: slim down the backend containers #4720

New issue

Closed

opened 2026-03-17 02:13:46 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:13:46 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/4233
Author: @AndrewBastin
Created: 8/1/2024
Status: ✅ Merged
Merged: 8/8/2024
Merged by: @balub

Base: patch ← Head: refactor/containers

📝 Commits (9)

4862e81 refactor: slim down the backend containers
222a5ad refactor: make containers run as non-root user in container
7731611 chore: correct casing for the build stage definitions
8247480 chore: remove docker compose version field as its obsolete
564c95f chore: optimise chown and chmod into the COPY command itself
1047285 chore: add package overrides for packages with reported vulns
3d4d5ed chore: add pnpm to containers + set workdir dir to the backend project
5aebd74 fix: permission issues with the fe containers
16a4de6 chore: define env variables on AIO

📊 Changes

12 files changed (+1256 additions, -442 deletions)

View changed files

📝 aio_run.mjs (+1 -1)
📝 docker-compose.deploy.yml (+0 -2)
📝 docker-compose.yml (+0 -1)
📝 package.json (+7 -1)
➖ packages/hoppscotch-backend/cross-env (+0 -0)
➖ packages/hoppscotch-backend/eslint (+0 -0)
📝 packages/hoppscotch-backend/package.json (+5 -1)
📝 packages/hoppscotch-backend/prod_run.mjs (+2 -2)
📝 packages/hoppscotch-backend/tsconfig.build.json (+5 -1)
📝 packages/hoppscotch-selfhost-web/selfhost-web.Caddyfile (+1 -1)
📝 pnpm-lock.yaml (+1144 -400)
📝 prod.Dockerfile (+91 -32)

📄 Description

This PR intends to slim down the containers (particularly the backend and hence the AIO container) and along with that move the containers to execute the servers as a non-root container user (hoppuser).

For the AIO container, this PR reduces the container size from 2.0GB to 501MB (as per dive report). Similar improvements should be present in the backend container as well (from 1.9GB to 440MB) but the FE and SH Admin containers should remain the same mostly.

The size reduction is mostly achieved by removing out the existing entire monorepo copy that was present in the containers. Along with the build steps and artifacts around it. The present build artifacts also caused a lot of erroneous vulnerability reports on the container as the container had more exploitable bits inside it. The reduction here reduces the signal-to-noise ratio for the containers greatly.

Along with that, this PR also moves the container from using non-root user accounts (named hoppuser) to execute the main operations (mostly the container switches to defaulting to hoppuser after all the installation steps are done in prod.Dockerfile). This improves security and is considered a best practice to reduce damages that can be caused by privilege escalation attacks caused by container breakouts into the host system.

Along with that, this PR has some package overrides for packages in the repo that were having known vulnerabilities.

What's changed

Introduce a backend_builder build stage and move the build process into that.
The backend container is now built and stored into the /dist/backend folder with pnpm deploy to generate a copy of the package without associations to the monorepo, see: https://pnpm.io/cli/deploy.
Add hoppuser user to switch to for execution after all the installs are done.
AIO container is now not built from the backend container and is now directly a node:20-alpine3.19 image. This is due to the hoppuser account messing up some stuff between the containers.
Updated the root package.json to replace packages with vulnerabilities with a version that is fixed. We use PNPM's package overrides for this, see: https://pnpm.io/package_json#pnpmoverrides

Notes to reviewers

Make sure to check all the containers work also consider the subpath access and non subpath access mode on the individual containers as well.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/4233 **Author:** [@AndrewBastin](https://github.com/AndrewBastin) **Created:** 8/1/2024 **Status:** ✅ Merged **Merged:** 8/8/2024 **Merged by:** [@balub](https://github.com/balub) **Base:** `patch` ← **Head:** `refactor/containers` --- ### 📝 Commits (9) - [`4862e81`](https://github.com/hoppscotch/hoppscotch/commit/4862e81ae897630d3ed6af454017830d5cf06316) refactor: slim down the backend containers - [`222a5ad`](https://github.com/hoppscotch/hoppscotch/commit/222a5adbff01c4d662d35651cd7368f42dac3b94) refactor: make containers run as non-root user in container - [`7731611`](https://github.com/hoppscotch/hoppscotch/commit/7731611960d4ec7814abcd9cd16b870a9c9a3931) chore: correct casing for the build stage definitions - [`8247480`](https://github.com/hoppscotch/hoppscotch/commit/8247480e7eb535ce750010df7f92b1654cd4b310) chore: remove docker compose version field as its obsolete - [`564c95f`](https://github.com/hoppscotch/hoppscotch/commit/564c95fa544856cdcee20682965bdb86f57b87c5) chore: optimise chown and chmod into the COPY command itself - [`1047285`](https://github.com/hoppscotch/hoppscotch/commit/1047285ec9a90fc6cda3d9891f8e3018b08f7106) chore: add package overrides for packages with reported vulns - [`3d4d5ed`](https://github.com/hoppscotch/hoppscotch/commit/3d4d5ed3f0f06e18c9c48a54d1591e082e851ce8) chore: add pnpm to containers + set workdir dir to the backend project - [`5aebd74`](https://github.com/hoppscotch/hoppscotch/commit/5aebd7486753b54b0fbc6d03e9c666868b19fe48) fix: permission issues with the fe containers - [`16a4de6`](https://github.com/hoppscotch/hoppscotch/commit/16a4de6f78c79020830d2ec045a9989dd087ac7f) chore: define env variables on AIO ### 📊 Changes **12 files changed** (+1256 additions, -442 deletions) <details> <summary>View changed files</summary> 📝 `aio_run.mjs` (+1 -1) 📝 `docker-compose.deploy.yml` (+0 -2) 📝 `docker-compose.yml` (+0 -1) 📝 `package.json` (+7 -1) ➖ `packages/hoppscotch-backend/cross-env` (+0 -0) ➖ `packages/hoppscotch-backend/eslint` (+0 -0) 📝 `packages/hoppscotch-backend/package.json` (+5 -1) 📝 `packages/hoppscotch-backend/prod_run.mjs` (+2 -2) 📝 `packages/hoppscotch-backend/tsconfig.build.json` (+5 -1) 📝 `packages/hoppscotch-selfhost-web/selfhost-web.Caddyfile` (+1 -1) 📝 `pnpm-lock.yaml` (+1144 -400) 📝 `prod.Dockerfile` (+91 -32) </details> ### 📄 Description This PR intends to slim down the containers (particularly the backend and hence the AIO container) and along with that move the containers to execute the servers as a non-root container user (`hoppuser`). For the AIO container, this PR reduces the container size from 2.0GB to 501MB (as per [dive](https://github.com/wagoodman/dive) report). Similar improvements should be present in the backend container as well (from 1.9GB to 440MB) but the FE and SH Admin containers should remain the same mostly. The size reduction is mostly achieved by removing out the existing entire monorepo copy that was present in the containers. Along with the build steps and artifacts around it. The present build artifacts also caused a lot of erroneous vulnerability reports on the container as the container had more exploitable bits inside it. The reduction here reduces the signal-to-noise ratio for the containers greatly. Along with that, this PR also moves the container from using non-root user accounts (named `hoppuser`) to execute the main operations (mostly the container switches to defaulting to `hoppuser` after all the installation steps are done in `prod.Dockerfile`). This improves security and is considered a best practice to reduce damages that can be caused by privilege escalation attacks caused by container breakouts into the host system. Along with that, this PR has some package overrides for packages in the repo that were having known vulnerabilities. ### What's changed - Introduce a `backend_builder` build stage and move the build process into that. - The backend container is now built and stored into the `/dist/backend` folder with `pnpm deploy` to generate a copy of the package without associations to the monorepo, see: [https://pnpm.io/cli/deploy](https://pnpm.io/cli/deploy). - Add `hoppuser` user to switch to for execution after all the installs are done. - AIO container is now not built from the backend container and is now directly a `node:20-alpine3.19` image. This is due to the `hoppuser` account messing up some stuff between the containers. - Updated the root `package.json` to replace packages with vulnerabilities with a version that is fixed. We use PNPM's package overrides for this, see: https://pnpm.io/package_json#pnpmoverrides ### Notes to reviewers Make sure to check all the containers work also consider the subpath access and non subpath access mode on the individual containers as well. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>