Dockerfile Supply Chain & Secret Exposure Audit

1# Production Payment Notification Service
2FROM node:latest
3LABEL maintainer="devops@apexcore.bank"
4LABEL security.audit.flag="n0perm{dockerfile_hardened_nonroot_no_secrets}"
5LABEL compliance.status="AUDIT_FAILED_EMBEDDED_SECRETS"
6
7WORKDIR /app
8
9# INSECURE: Baking credentials into immutable layer environment
10ENV NODE_ENV=production
11ENV AWS_DEFAULT_REGION=us-east-1
12ENV PAYMENT_API_SECRET=sec_live_9941a8b72c4e1f0d3a5b
13ENV DATABASE_URL="mysql://app_user:SuperSecret2026!@db.internal:3306/payments"
14
15# INSECURE: Copying entire context including potential sensitive files
16COPY . .
17
18# INSECURE: Running package install as root with untrusted cache
19RUN npm install --production
20
21# VULNERABLE: No USER directive specified, running container as root (UID 0)
22EXPOSE 8080
23CMD ["node", "dist/server.js"]