Refactor Dockerfile for multi-stage build and dependencies

Updated Dockerfile for improved security and efficiency.

1 files changed, 66 insertions, 32 deletions

diff --git a/Dockerfile b/Dockerfile
index 8ba2353..07f6d38 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,60 +1,94 @@
-# VaporDrop - Multi-stage Docker Build
-# Stack: Go + Tor + X25519 + XChaCha20 + BLAKE3
-
 # =============================================================================
-# STAGE 1: Build
+# VAPORDROP - DOCKERFILE HARDENED
+# Multi-stage build per minimizzare attack surface
 # =============================================================================
-FROM golang:1.21-alpine AS builder
 
-RUN apk add --no-cache git ca-certificates tzdata
+# -----------------------------------------------------------------------------
+# STAGE 1: Build
+# -----------------------------------------------------------------------------
+FROM golang:1.22-alpine AS builder
+
+# Build dependencies
+RUN apk add --no-cache git ca-certificates
 
 WORKDIR /build
 
-# Copy source files
-COPY go.mod ./
-COPY main.go ./
+# Cache dipendenze
+COPY go.mod go.sum* ./
+RUN go mod download 2>/dev/null || true
 
-# Download dependencies and build with security flags
-RUN go mod tidy && \
-    CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
-    go build \
+# Copia sorgenti
+COPY main.go .
+
+# Init module se non esiste
+RUN [ -f go.mod ] || go mod init vapordrop
+
+# Scarica dipendenze
+RUN go mod tidy
+
+# Compilazione statica senza CGO
+# -ldflags: strip symbols, disable DWARF
+# -trimpath: rimuove path locali dal binario
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
+    -ldflags="-s -w -extldflags '-static'" \
     -trimpath \
-    -ldflags="-w -s -buildid=" \
-    -buildvcs=false \
     -o vapordrop \
     main.go
 
-# =============================================================================
+# Verifica binario
+RUN ./vapordrop --help 2>&1 || true
+
+# -----------------------------------------------------------------------------
 # STAGE 2: Runtime
-# =============================================================================
-FROM alpine:3.19
+# -----------------------------------------------------------------------------
+FROM debian:bookworm-slim
+
+# Labels
+LABEL maintainer="VaporDrop"
+LABEL description="Ephemeral messaging over Tor"
+LABEL security.privileged="false"
+
+# Variabili ambiente per Tor
+ENV TOR_SKIP_LAUNCH=1
+ENV HOME=/app
 
-# Install Tor and minimal deps
-RUN apk add --no-cache \
+# Installa solo il necessario
+RUN apt-get update && apt-get install -y --no-install-recommends \
     tor \
     ca-certificates \
-    tzdata \
-    && rm -rf /var/cache/apk/* \
-    && mkdir -p /app/static /app/file_storage /app/.tor
+    && rm -rf /var/lib/apt/lists/* \
+    && rm -rf /var/cache/apt/*
 
-# Create non-root user
-RUN addgroup -g 1000 vapor && \
-    adduser -u 1000 -G vapor -h /app -D vapor
+# Crea utente non-root
+RUN groupadd -g 1000 vapor && useradd -r -s /bin/false -d /app -u 1000 -g 1000 vapor
 
+# Directory applicazione
 WORKDIR /app
 
-# Copy binary from builder
+# Copia binario
 COPY --from=builder /build/vapordrop /app/vapordrop
 
-# Copy static files
+# Copia static files (se presenti)
 COPY static/ /app/static/
 
-# Set ownership
-RUN chown -R vapor:vapor /app
+# Permessi
+RUN chown -R vapor:vapor /app && \
+    chmod 500 /app/vapordrop && \
+    chmod 400 /app/static/* 2>/dev/null || true
 
-# Switch to non-root
+# Directory temporanea per Tor (in RAM via tmpfs in docker-compose)
+RUN mkdir -p /tmp/tor && chown vapor:vapor /tmp/tor
+
+# Switch a utente non privilegiato
 USER vapor
 
-EXPOSE 80
+# Health check
+HEALTHCHECK --interval=60s --timeout=10s --start-period=120s --retries=3 \
+    CMD test -f /tmp/tor/.tor_is_ready || exit 1
+
+# Espone porta Tor (non necessario per hidden service, ma utile per debug)
+EXPOSE 9050
 
+# Entry point
 ENTRYPOINT ["/app/vapordrop"]
+