$ show nodejs/docker-node
This repository is the source of truth for the official Node.js Docker images published on Docker Hub. It contains no application runtime code; it is a release-engineering and build-automation repo that owns three concerns: (1) template-based Dockerfile generation across Node.js major versions 22/24/26 and variants (Alpine 3.23/3.24, Debian bookworm/trixie, and slim flavors), (2) continuous detection of new Node.js releases, and (3) generation of the stackbrew manifest consumed by docker-library/official-images, which triggers the actual Docker Hub build. The generated Dockerfiles perform GPG-verified SHA-256 checksum validation of Node.js tarballs, multi-architecture dispatch (binary download where official musl/glibc builds exist, source compilation otherwise), OpenSSL header pruning to save ~34MB, apt/apk dependency minimization, and runtime smoke tests of node/npm/yarn. The core pipeline is fully automated: a GitHub Actions cron runs every 15 minutes, executing build-automation.mjs which queries nodejs.org/download/release/index.json, detects newer releases, and invokes update.sh. update.sh is the heart of the repo — a bash generator that expands three Dockerfile templates by injecting GPG release keys, architecture-to-binary switch cases, and per-major-version policy (Yarn v1 is stripped for Node >=26; rust/cargo toolchain is stripped for Node <26 since Temporal doesn't require it). When an update PR merges, official-pr.yml regenerates the stackbrew manifest via stackbrew.js and opens a PR against docker-library/official-images. A diff-aware test matrix (genMatrix.js) builds every affected Dockerfile in CI and asserts the resulting node/npm/yarn versions. Craftsmanship is strong: shell scripts are organized as a reusable utility library (functions.sh), linted with shfmt/ShellCheck and ESLint/Prettier/doctoc; GitHub Actions are pinned to commit SHAs; OpenSSF Scorecard supply-chain analysis runs; release GPG keys are synced automatically from nodejs/release-keys. The most transferable artifacts are update.sh (declarative template-to-Dockerfile generation), stackbrew.js (release-schedule-driven tag policy), genMatrix.js (diff-aware CI matrix generation), and docker-entrypoint.sh (the canonical runtime-command dispatch pattern with a documented ash/dash bug workaround). The repo is actively maintained — it tracks current Node.js 26, Alpine 3.24, and Debian 13 (trixie) — and is monolithic in structure but cohesive: a single-purpose infrastructure repo rather than a data/research project.
The LLM identified 5 files worth highlighting for reuse:
The core Dockerfile generator. Takes three base templates (Alpine/Debian/slim), injects Node.js release GPG keys, architecture-to-binary mapping switch cases, and per-major-version build policy (strips Yarn v1 for Node >=26, strips rust/cargo for Node <26), then writes 18+ variant Dockerfiles. Uses multiline sed continuations to expand bash array placeholders like ${NODE_KEYS[@]} — a difficult, non-obvious technique. Runs variant updates in parallel via background pids, is idempotent (diffs before moving temp files), and propagates failures. The pattern — declarative Dockerfile generation from templates plus metadata — transfers directly to any project maintaining multiple base-image variants.
Self-contained Node script that generates the docker-library stackbrew manifest consumed by Docker Hub. Walks versions.json release dates (start/lts/maintenance/end/codename) and per-version variant metadata to compute floating tags (major/minor/patch, codename, alpine, slim, latest, lts, current), then emits the GitCommit/Directory/Architectures block for every image. The date-driven tag-policy computation depends only on fs/path and is a reusable pattern for any multi-variant container publishing pipeline.
Generates a GitHub Actions build matrix from the changed-file set. Filters to only affected Dockerfiles and docker-entrypoint.sh changes, expands entrypoint edits to their parent Dockerfiles, parses ENV NODE_VERSION from each Dockerfile to derive version/variant, and falls back to testing everything when the matrix generator itself changes. Pure-function style with only fs/path dependencies; a portable pattern for diff-aware CI in generated-artifact repositories.
The canonical language-runtime container entrypoint: if argv[1] starts with '-' or is not an executable found on PATH (or is a non-executable file), it transparently prepends `node`. Includes a documented workaround for the ash/dash bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264 via the `{ [ -f "${1}" ] && ! [ -x "${1}" ]; }` guard. This exact pattern has run in the most-downloaded official Docker images for over a decade and is a reference implementation for any runtime base image.
Builds minimal Debian-slim Node images by computing the runtime shared-library closure: after installing Node, it runs ldd over all executables in /usr/local, maps each loaded library to its owning Debian package via dpkg-query, marks those packages manual, then purges everything else with apt-get --auto-remove. This reverse-dependency pruning keeps only what the binary actually needs and is a transferable Dockerfile technique for any self-contained compiled artifact.