Distroless containers
If using a distroless Node.js container then there is no npm or shell installed in the container image. You must use the NODE_OPTIONS
environment variable to run the agent as a required module.
However, be careful when using NODE_OPTIONS
since this will run the agent with all node or npm commands and may result in unintended execution resulting in longer start-up times.
Example:
FROM node:18 as installer COPY . /juice-shop WORKDIR /juice-shop RUN npm i -g typescript ts-node RUN npm install --omit=dev --unsafe-perm # install the latest agent RUN npm install @contrast/agent RUN npm dedupe RUN rm -rf frontend/node_modules RUN rm -rf frontend/.angular RUN rm -rf frontend/src/assets RUN mkdir logs RUN chown -R 65532 logs RUN chgrp -R 0 ftp/ frontend/dist/ logs/ data/ i18n/ RUN chmod -R g=u ftp/ frontend/dist/ logs/ data/ i18n/ RUN rm data/chatbot/botDefaultTrainingData.json || true RUN rm ftp/legal.md || true RUN rm i18n/*.json || true FROM gcr.io/distroless/nodejs:18 ARG BUILD_DATE ARG VCS_REF LABEL maintainer="Bjoern Kimminich <bjoern.kimminich@owasp.org>" \ org.opencontainers.image.title="OWASP Juice Shop" \ org.opencontainers.image.description="Probably the most modern and sophisticated insecure web application" \ org.opencontainers.image.authors="Bjoern Kimminich <bjoern.kimminich@owasp.org>" \ org.opencontainers.image.vendor="Open Web Application Security Project" \ org.opencontainers.image.documentation="https://help.owasp-juice.shop" \ org.opencontainers.image.licenses="MIT" \ org.opencontainers.image.version="14.5.1" \ org.opencontainers.image.url="https://owasp-juice.shop" \ org.opencontainers.image.source="https://github.com/juice-shop/juice-shop" \ org.opencontainers.image.revision=$VCS_REF \ org.opencontainers.image.created=$BUILD_DATE WORKDIR /juice-shop COPY --from=installer --chown=65532:0 /juice-shop . USER 65532 EXPOSE 3000 ENV NODE_OPTIONS "--import @contrast/agent" CMD ["/juice-shop/build/app.js"]