Strip npm CLI from runtime image to eliminate its vulnerable dependency tree

Author: zainabimran06

Dockerfile

@@ -1,18 +1,16 @@
-# syntax=docker/dockerfile:1
-
-# Stage 1: install dependencies only
-FROM node:22-alpine AS deps
-WORKDIR /app
-COPY package.json package-lock.json ./
-RUN npm ci --omit=dev
-
-# Stage 2: slim runtime image
 FROM node:22-alpine AS runtime
 WORKDIR /app
 ENV NODE_ENV=production
 
 COPY --from=deps /app/node_modules ./node_modules
 COPY --chown=node:node . .
+
+# The base image bundles the full npm CLI and its dependency tree for
+# `npm install`-type use. This container only ever runs `node src/index.js`
+# — npm/npx are never invoked at runtime — so remove them rather than ship
+# vulnerable code that's never executed.
+RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack
+
 USER node
 
 EXPOSE 3000