Tighten Dockerfile: pinning, certs, GPG hygiene

.github/workflows/build.yml

@@ -0,0 +1,19 @@
+name: Build the docker container
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-24.04
+    if: ${{ !contains(github.event.head_commit.message, 'docs:') }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Build an image from Dockerfile
+        run: |
+          docker buildx install
+          docker buildx build --load --platform linux/amd64 -t docker.io/sitespeedio/node:${{ github.sha }} .

Dockerfile

@@ -1,31 +1,30 @@
-FROM ubuntu:noble-20260210.1
+FROM ubuntu:noble-20260410
 
 ARG TARGETPLATFORM
 
 # Dockerfile originally based on https://github.com/nodejs/docker-node/blob/master/6.11/slim/Dockerfile
 # gpg keys listed at https://github.com/nodejs/node#release-team
 
 ENV NPM_CONFIG_LOGLEVEL=info
-ENV NODE_VERSION=24.14.0
+ENV NODE_VERSION=24.15.0
 
 RUN export PLATFORM=$(if [ "$TARGETPLATFORM" = "linux/amd64" ] ; then echo "x64"; else echo "arm64"; fi) \
-  buildDeps='xz-utils curl ca-certificates gnupg2 lsb-release dirmngr' \
+  && buildDeps='xz-utils curl gnupg2 lsb-release dirmngr' \
   && set -x \
-  && apt-get update && apt-get upgrade -y && apt-get install -y $buildDeps --no-install-recommends \
+  && apt-get update && apt-get install -y --no-install-recommends ca-certificates $buildDeps \
   && rm -rf /var/lib/apt/lists/* \
   # gpg keys listed at https://github.com/nodejs/node#release-keys
   && set -ex \
+  && export GNUPGHOME="$(mktemp -d)" \
   && for key in \
-    4ED778F539E3634C779C87C6D7062848A1AB005C \
-    141F07595B7B3FFE74309A937405533BE57C7D57 \
-    74F12602B6F1C4E913FAA37AD3A89613643B6201 \
-    61FC681DFB92A079F1685E77973F295594EC4689 \
+    5BE8A3F6C8A5C01D106C0AD820B1A390B168D356 \
+    DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 \
+    CC68F5A3106FF448322E48ED27F5E38D5B0A215F \
     8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 \
-    C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8 \
     890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 \
     C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C \
     108F52B48DB57BB0CC439B2997B01419BD92F80A \
-    CC68F5A3106FF448322E48ED27F5E38D5B0A215F \
+    A363A499291CBBC940DD62E41F10027AF002F8B0 \
   ; do \
     gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" || \
     gpg --batch --keyserver keyserver.ubuntu.com  --recv-keys "$key" ; \
@@ -36,6 +35,8 @@ RUN export PLATFORM=$(if [ "$TARGETPLATFORM" = "linux/amd64" ] ; then echo "x64"
   && grep " node-v$NODE_VERSION-linux-$PLATFORM.tar.xz\$" SHASUMS256.txt | sha256sum -c - \
   && tar -xJf "node-v$NODE_VERSION-linux-$PLATFORM.tar.xz" -C /usr/local --strip-components=1 \
   && rm "node-v$NODE_VERSION-linux-$PLATFORM.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt \
+  && { gpgconf --kill all || true; } \
+  && rm -rf "$GNUPGHOME" \
   && apt-get purge -y --auto-remove $buildDeps \
   && ln -s /usr/local/bin/node /usr/local/bin/nodejs