Using base Alpine images for production frontend builds is standard practice, but container security scanners like Trivy frequently flag high-severity CVEs in embedded packages such as libcrypto, ssl, or shell engines that aren't actually needed for static artifact hosting.
The Vulnerability
By hosting standard bundles inside images with unneeded shells (busybox, sh), we widen the container attack surface. Securing these requires removing unused packages completely.
Remediation Strategy
We migrated the Dockerfiles to multi-stage builds. The assets are built in Node-Alpine, but the final host stage copies the output to a hardened, minimal distroless image or custom nginx-alpine configuration containing no shell utilities.
# Stage 1: Build
FROM node:20-alpine AS builder
WORKDIR /app
COPY . .
RUN npm ci && npm run build
# Stage 2: Hardened Run
FROM gcr.io/distroless/nodejs20-debian12
COPY --from=builder /app /app
WORKDIR /app
CMD ["server.js"]
Outcome
Reduced container image size by 45%, eliminated 100% of critical CVE logs, and satisfied enterprise compliance standards.