feat: Use hardended docker images (#23480)

.github/actions/docker-registry-login/action.yml

@@ -13,11 +13,15 @@ inputs:
     description: 'Login to DockerHub'
     required: false
     default: 'false'
+  login-dhi:
+    description: 'Login to Docker Hardened Images registry (dhi.io)'
+    required: false
+    default: 'false'
   dockerhub-username:
-    description: 'DockerHub username (required if login-dockerhub is true)'
+    description: 'DockerHub username (required if login-dockerhub or login-dhi is true)'
     required: false
   dockerhub-password:
-    description: 'DockerHub password (required if login-dockerhub is true)'
+    description: 'DockerHub password (required if login-dockerhub or login-dhi is true)'
     required: false
 
 runs:
@@ -37,3 +41,11 @@ runs:
       with:
         username: ${{ inputs.dockerhub-username }}
         password: ${{ inputs.dockerhub-password }}
+
+    - name: Login to DHI Registry
+      if: inputs.login-dhi == 'true'
+      uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+      with:
+        registry: dhi.io
+        username: ${{ inputs.dockerhub-username }}
+        password: ${{ inputs.dockerhub-password }}

.github/workflows/docker-base-image.yml

@@ -32,12 +32,20 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
-      - name: Login to Docker registries
+      - name: Login to DHI Registry (for pulling base images)
+        uses: ./.github/actions/docker-registry-login
+        with:
+          login-ghcr: 'false'
+          login-dhi: 'true'
+          dockerhub-username: ${{ secrets.DOCKER_USERNAME }}
+          dockerhub-password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Login to Docker registries (for pushing)
         if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.push == true)
         uses: ./.github/actions/docker-registry-login
         with:
-          login-ghcr: true
-          login-dockerhub: true
+          login-ghcr: 'true'
+          login-dockerhub: 'true'
           dockerhub-username: ${{ secrets.DOCKER_USERNAME }}
           dockerhub-password: ${{ secrets.DOCKER_PASSWORD }}
 

docker/images/n8n-base/Dockerfile

@@ -1,24 +1,18 @@
 ARG NODE_VERSION=22.21.1
 
-# ==============================================================================
-# STAGE 1: Builder for Base Dependencies
-# ==============================================================================
-FROM node:${NODE_VERSION}-alpine AS builder
+FROM dhi.io/node:${NODE_VERSION}-alpine3.22-dev
 
-# Install fonts
-RUN \
-  apk --no-cache add --virtual .build-deps-fonts msttcorefonts-installer fontconfig && \
-  update-ms-fonts && \
-  fc-cache -f && \
-  apk del .build-deps-fonts && \
-  find /usr/share/fonts/truetype/msttcorefonts/ -type l -exec unlink {} \;
-
-# Install essential OS dependencies
-RUN echo "https://dl-cdn.alpinelinux.org/alpine/v3.22/main" >> /etc/apk/repositories && \
-    echo "https://dl-cdn.alpinelinux.org/alpine/v3.22/community" >> /etc/apk/repositories && \
+# Install all dependencies in a single layer to minimize image size
+RUN apk add --no-cache busybox-binsh && \
+    # Install fonts
+    apk --no-cache add --virtual .build-deps-fonts msttcorefonts-installer fontconfig && \
+    update-ms-fonts && \
+    fc-cache -f && \
+    apk del .build-deps-fonts && \
+    find /usr/share/fonts/truetype/msttcorefonts/ -type l -exec unlink {} \; && \
+    # Install OS dependencies
     apk update && \
     apk upgrade --no-cache && \
-    apk add --no-cache libxml2 && \
     apk add --no-cache \
         git \
         openssh \
@@ -27,22 +21,12 @@ RUN echo "https://dl-cdn.alpinelinux.org/alpine/v3.22/main" >> /etc/apk/reposito
         tini \
         tzdata \
         ca-certificates \
-        libc6-compat \
-        jq
-
-# Install full-icu
-RUN npm install -g full-icu@1.5.0
-
-RUN rm -rf /tmp/* /root/.npm /root/.cache/node
-
-# ==============================================================================
-# STAGE 2: Final Base Runtime Image
-# ==============================================================================
-FROM node:${NODE_VERSION}-alpine
-
-COPY --from=builder / /
-
-RUN rm -rf /opt/yarn* && apk del apk-tools
+        libc6-compat && \
+    # Install full-icu
+    npm install -g full-icu@1.5.0 && \
+    # Cleanup
+    rm -rf /tmp/* /root/.npm /root/.cache/node /opt/yarn* && \
+    apk del apk-tools
 
 WORKDIR /home/node
 ENV NODE_ICU_DATA=/usr/local/lib/node_modules/full-icu

docker/images/n8n/Dockerfile

@@ -1,15 +1,7 @@
 ARG NODE_VERSION=22.21.1
 ARG N8N_VERSION=snapshot
 
-# ==============================================================================
-# STAGE 1: System Dependencies & Base Setup
-# ==============================================================================
-FROM n8nio/base:${NODE_VERSION} AS system-deps
-
-# ==============================================================================
-# STAGE 2: Final Runtime Image
-# ==============================================================================
-FROM system-deps AS runtime
+FROM n8nio/base:${NODE_VERSION}
 
 ARG N8N_VERSION
 ARG N8N_RELEASE_TYPE=dev
@@ -23,14 +15,12 @@ WORKDIR /home/node
 COPY ./compiled /usr/local/lib/node_modules/n8n
 COPY docker/images/n8n/docker-entrypoint.sh /
 
-# This version of npm has the fix for glob
-RUN npm install -g npm@11.6.4
-
 RUN cd /usr/local/lib/node_modules/n8n && \
-		npm rebuild sqlite3 && \
-		ln -s /usr/local/lib/node_modules/n8n/bin/n8n /usr/local/bin/n8n && \
+    npm rebuild sqlite3 && \
+    ln -s /usr/local/lib/node_modules/n8n/bin/n8n /usr/local/bin/n8n && \
     mkdir -p /home/node/.n8n && \
-    chown -R node:node /home/node
+    chown -R node:node /home/node && \
+    rm -rf /root/.npm /tmp/*
 
 EXPOSE 5678/tcp
 USER node