A test-gated container build

Build the fixed app as a non-root user, with tests and a health check.

Where it goes

Save as Dockerfile beside the fixed app.mjs, security.test.mjs, and verify-lab.mjs from the starter kit.

Download Dockerfile ↓Open lab 03 →

How to use this file

Save this Dockerfile beside the fixed app.mjs, security.test.mjs, and verify-lab.mjs from the starter kit.
Start Docker with Linux containers, then open a terminal in that folder.
Run docker build -t opsrung-lab:local . — include the final dot.
Expect the five security tests to pass during the build. A failing test should stop the build.
Run docker image inspect opsrung-lab:local --format "{{.Config.User}}". Expect node.

Open lab 03 and select Docker for the full walkthrough. The Local machine route does not need this file.

Dockerfile

# Learning template for the fixed Fieldnotes fixture. Build from the kit folder.
# For a real release, select and maintain a reviewed base-image digest.
FROM node:24-alpine
WORKDIR /app
COPY --chown=node:node app.mjs security.test.mjs verify-lab.mjs ./
USER node
# A broken ownership check stops the image build.
RUN node --test security.test.mjs
ENV NODE_ENV=production
ENV HOST=0.0.0.0
EXPOSE 3000
HEALTHCHECK --interval=15s --timeout=3s --start-period=5s --retries=3 CMD node -e "fetch('http://127.0.0.1:3000/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
CMD ["node", "app.mjs"]