From 9832bbd469faec7613f024d665f156c3a66d9692 Mon Sep 17 00:00:00 2001
From: Yann Jouanique <yann.jouanique@gmail.com>
Date: Fri, 4 Nov 2022 17:10:06 +0100
Subject: [PATCH] build: Mutli-stage build and slim image for websocket
 container (#21954)

---
 .github/workflows/docker_build_push.sh | 13 +++++++++++++
 superset-websocket/Dockerfile          | 25 ++++++++++++++++++++-----
 superset-websocket/package-lock.json   |  2 +-
 3 files changed, 34 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/docker_build_push.sh b/.github/workflows/docker_build_push.sh
index 4feea5d802..1c3723611f 100755
--- a/.github/workflows/docker_build_push.sh
+++ b/.github/workflows/docker_build_push.sh
@@ -56,6 +56,19 @@ docker build --target lean \
   --label "build_actor=${GITHUB_ACTOR}" \
   .
 
+#
+# Build the "websocket" image
+#
+docker build \
+  -t "${REPO_NAME}-websocket:${SHA}" \
+  -t "${REPO_NAME}-websocket:${REFSPEC}" \
+  -t "${REPO_NAME}-websocket:${LATEST_TAG}" \
+  --label "sha=${SHA}" \
+  --label "built_at=$(date)" \
+  --label "target=lean" \
+  --label "build_actor=${GITHUB_ACTOR}" \
+  superset-websocket
+
 #
 # Build the dev image
 #
diff --git a/superset-websocket/Dockerfile b/superset-websocket/Dockerfile
index 85ff66520d..4cc2117f07 100644
--- a/superset-websocket/Dockerfile
+++ b/superset-websocket/Dockerfile
@@ -12,13 +12,28 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-FROM node:16
+FROM node:16-alpine as build
 
 WORKDIR /home/superset-websocket
 
-COPY . .
+COPY . ./
 
-RUN npm ci
-RUN npm run build
+RUN npm ci && \
+  npm run build
 
-CMD ["npm", "start"]
+
+FROM node:16-alpine
+
+ENV NODE_ENV=production
+WORKDIR /home/superset-websocket
+
+COPY --from=build /home/superset-websocket/dist ./dist
+COPY package*.json ./
+
+# Only install production dependencies
+RUN npm ci --omit=dev
+
+# Don't run as root!
+USER node
+
+CMD [ "npm", "start" ]
diff --git a/superset-websocket/package-lock.json b/superset-websocket/package-lock.json
index c979bcc646..dc43cfff8f 100644
--- a/superset-websocket/package-lock.json
+++ b/superset-websocket/package-lock.json
@@ -37,7 +37,7 @@
       },
       "engines": {
         "node": "^16.9.1",
-        "npm": "^7.5.4"
+        "npm": "^7.5.4 || ^8.1.2"
       }
     },
     "node_modules/@babel/code-frame": {