build: Mutli-stage build and slim image for websocket container (#21954)

.github/workflows/docker_build_push.sh

@@ -56,6 +56,19 @@ docker build --target lean \
   --label "build_actor=${GITHUB_ACTOR}" \
   .
 
+#
+# Build the "websocket" image
+#
+docker build \
+  -t "${REPO_NAME}-websocket:${SHA}" \
+  -t "${REPO_NAME}-websocket:${REFSPEC}" \
+  -t "${REPO_NAME}-websocket:${LATEST_TAG}" \
+  --label "sha=${SHA}" \
+  --label "built_at=$(date)" \
+  --label "target=lean" \
+  --label "build_actor=${GITHUB_ACTOR}" \
+  superset-websocket
+
 #
 # Build the dev image
 #

superset-websocket/Dockerfile

@@ -12,13 +12,28 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-FROM node:16
+FROM node:16-alpine as build
 
 WORKDIR /home/superset-websocket
 
-COPY . .
+COPY . ./
 
-RUN npm ci
-RUN npm run build
+RUN npm ci && \
+  npm run build
 
-CMD ["npm", "start"]
+
+FROM node:16-alpine
+
+ENV NODE_ENV=production
+WORKDIR /home/superset-websocket
+
+COPY --from=build /home/superset-websocket/dist ./dist
+COPY package*.json ./
+
+# Only install production dependencies
+RUN npm ci --omit=dev
+
+# Don't run as root!
+USER node
+
+CMD [ "npm", "start" ]

superset-websocket/package-lock.json

@@ -37,7 +37,7 @@
       },
       "engines": {
         "node": "^16.9.1",
-        "npm": "^7.5.4"
+        "npm": "^7.5.4 || ^8.1.2"
       }
     },
     "node_modules/@babel/code-frame": {