build(docker): Switch to Docker Hardened Images (DHI)

[oioki]

Switch both builder and runtime stages to Docker Hardened Images (DHI).

Before: builder and runtime both used node:24.14.0/node:24.14.0-slim (Debian 12), with canvas system libraries installed via apt-get in the runtime. Trivy reported 1,457 vulnerabilities (3 CRITICAL, 148 HIGH) across 288 OS packages, compressed image size ~502 MB.

After: builder uses us-docker.pkg.dev/sentryio/dhi/node:24-debian13-dev, runtime uses the minimal us-docker.pkg.dev/sentryio/dhi/node:24-debian13 (Debian 13, distroless — no shell, no apt). Trivy reports 10 vulnerabilities (0 CRITICAL, 1 HIGH) across 24 OS packages, compressed image size ~85 MB.

  ┌────────────────┬────────────────────────────────────────┬─────────────────────────────┬────────┐
  │     Metric     │       Before (node:24.14.0-slim)       │         After (DHI          │ Change │
  │                │                                        │      node:24-debian13)      │        │
  ├────────────────┼────────────────────────────────────────┼─────────────────────────────┼────────┤
  │ Compressed     │ ~502 MB                                │ ~85 MB                      │ −83%   │
  │ size           │                                        │                             │        │
  ├────────────────┼────────────────────────────────────────┼─────────────────────────────┼────────┤
  │ OS             │ Debian 12.13 (bookworm)                │ Debian 13.3 (trixie)        │        │
  ├────────────────┼────────────────────────────────────────┼─────────────────────────────┼────────┤
  │ OS packages    │ 288                                    │ 24                          │ −92%   │
  ├────────────────┼────────────────────────────────────────┼─────────────────────────────┼────────┤
  │ OS vulns       │ 1455 (C:3 H:148 M:659 L:644 U:1)       │ 10 (C:0 H:1 M:2 L:7)        │ −99%   │
  ├────────────────┼────────────────────────────────────────┼─────────────────────────────┼────────┤
  │ npm vulns      │ 2 HIGH (minimatch                      │ 0                           │ −100%  │
  │                │ CVE-2026-27903/27904)                  │                             │        │
  ├────────────────┼────────────────────────────────────────┼─────────────────────────────┼────────┤
  │ Total vulns    │ 1457                                   │ 10                          │ −99%   │
  └────────────────┴────────────────────────────────────────┴─────────────────────────────┴────────┘

How the builder conflict was resolved

DHI's pre-installed libexpat1 2.7.4 (arch:all) conflicts with canvas's build dependencies (libcairo2-dev → libfontconfig-dev → libexpat1-dev requires exactly libexpat1 = 2.7.1-2). This turned out not to matter: canvas 3.x uses node-pre-gyp to download pre-built binaries at install time, so no system canvas libraries are needed in the builder at all.

How the minimal runtime was made to work

canvas 3.x bundles all its graphics libs (libcairo, libpango, librsvg, etc.) in node_modules/canvas/build/Release/, so no system canvas libraries are needed at runtime either. However, the bundled librsvg/glib still need four basic system libs absent from the distroless image (libz, libexpat, libuuid, liblzma). These are collected in the builder stage and copied into the runtime with COPY --from=builder /canvas-sys-libs/ /, avoiding the need for the full -dev image.

The smoke-test RUN uses exec form since the minimal image has no shell.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[sentry]

Bug: The Dockerfile's smoke test uses node lib/index.js --help, which never imports the canvas module, failing to validate its native dependencies.
_{Severity: CRITICAL}

Suggested Fix

Modify the smoke test to invoke a command that actually loads the canvas module. For example, run a minimal render command that triggers the import of render.ts. This will ensure that the canvas module and its system library dependencies are correctly loaded and validated during the Docker build.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: Dockerfile#L36

Potential issue: The smoke test command `node lib/index.js --help` exits before any
command handlers are executed. Consequently, the `canvas` module and its native
dependencies are never loaded or tested during the build process. If the required system
libraries for `canvas` are missing from the builder image, the build will still succeed,
but the application will crash at runtime when the first render request is made and it
attempts to load the `canvas` module. This creates a situation where a non-functional
image can be deployed to production.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

[oioki]

Let's ignore, that's the previous behavior.

[geoffg-sentry]

yolo