Install Node from the official node image

Alpine's nodejs package is still 24.18.1, which trusts the compromised
eMudhra intermediates. node:24-alpine3.24 ships Node 24.22.1, which rejects
them, so copy Node, npm, corepack and yarn from it and fail the build below
24.22.1. That makes the NODE_OPTIONS=--use-openssl-ca workaround and its
entrypoint handling unnecessary, so drop both.

Author: lelia

CHANGELOG.md

@@ -7,6 +7,8 @@
 - The CLI and every tool in the Docker image now reject certificates issued
   from the compromised eMudhra intermediate CAs.
 - Bumped `certifi` to `2026.10.19` and the image's bundled `uv` to `0.13.4`.
+- The image now takes Node.js from the official `node:24-alpine` image (`24.22.1`)
+  instead of Alpine's `nodejs` package, which hasn't shipped Node's fix.
 
 ### Changed: bump pinned Coana CLI to 15.12.11
 

Dockerfile

@@ -1,3 +1,8 @@
+# Node.js from the official Alpine image instead of Alpine's nodejs package, which
+# lags Node's security releases. Match the major version to what reachability needs
+# and the Alpine release to the python:3-alpine base below.
+FROM node:24-alpine3.24 AS node
+
 FROM python:3-alpine
 LABEL org.opencontainers.image.authors="socket.dev"
 
@@ -18,11 +23,24 @@ ARG USE_LOCAL_INSTALL=false
 # compromised eMudhra intermediates chain to. The base image ships an older
 # one, and `apk add` does not upgrade installed packages, so upgrade it here.
 RUN apk update && apk add --no-cache \
-        git nodejs npm yarn curl wget \
+        git curl wget \
         ruby ruby-dev build-base strace && \
     apk upgrade --no-cache ca-certificates && \
     [ "$(apk version -t "$(apk list -I ca-certificates | awk '{print $1}' | sed 's/^ca-certificates-//')" 20261020-r0)" != "<" ]
 
+# npm, npx and yarn are symlinks in the node image. COPY would dereference them
+# into flat files and break their relative requires, so recreate the links.
+COPY --from=node /usr/local/bin/node /usr/local/bin/node
+COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
+COPY --from=node /opt /opt
+# Node rejects the compromised eMudhra intermediates from 24.22.1.
+RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm && \
+    ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx && \
+    ln -s ../lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack && \
+    ln -s /opt/yarn-v*/bin/yarn /usr/local/bin/yarn && \
+    ln -s /opt/yarn-v*/bin/yarnpkg /usr/local/bin/yarnpkg && \
+    node -e 'const [a,b,c]=process.versions.node.split(".").map(Number); process.exit(a>24||(a===24&&(b>22||(b===22&&c>=1)))?0:1)'
+
 # Install Go with version control
 RUN if [ "$GO_VERSION" = "system" ]; then \
         apk add --no-cache go && \
@@ -89,10 +107,6 @@ RUN npm install socket -g && \
 # Set environment paths
 ENV PATH="/usr/local/go/bin:/usr/lib/go/bin:/root/.cargo/bin:${PATH}"
 ENV GOPATH="/go"
-# Node only rejects the compromised eMudhra intermediates from 22.23.4 / 24.22.1,
-# and Alpine's nodejs package is older. Use the system store, which ca-certificates
-# above already fixed. Drop this once Alpine's nodejs includes Node's fix.
-ENV NODE_OPTIONS="--use-openssl-ca"
 
 # Install uv (0.13.4+ ships the patched webpki-roots)
 COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /usr/local/bin/uv