Don't install non prod deps for docker build

digitalservicebund · Nov 29, 2024 · 5fd0470 · 5fd0470
1 parent e515bcc
commit 5fd0470
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/Dockerfile b/Dockerfile
@@ -11,7 +11,9 @@ FROM node:20-alpine AS production-dependencies
 ENV NODE_ENV=production
 WORKDIR /src
 COPY package*.json ./
-RUN npm ci
+# TODO: Remove omits, when CVE-2024-21538 is fixed (https://scout.docker.com/vulnerabilities/id/CVE-2024-21538?s=github)
+# RUN npm ci
+RUN npm ci --omit=dev --omit=optional
 
 # Build the app
 FROM node:20-alpine AS build