snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/.docker/Dockerfile.alpine

@@ -0,0 +1,102 @@
+FROM node:24.15.0-alpine3.23 AS builder
+
+ENV LANG=C.UTF-8
+
+RUN apk add --no-cache python3 make g++ py3-setuptools libc6-compat
+
+COPY . /app
+
+ENV NODE_ENV=production
+
+RUN cd /app/bundle/programs/server \
+    && npm install --omit=dev \
+    && npm cache clean --force \
+    # Drop sourcemaps from third-party prod deps and the client bundle:
+    #   - server/npm/node_modules: .map files shipped inside packages
+    #     (openpgp, date-fns, etc.). Node does not read them at runtime.
+    #   - web.browser: client-side bundle, maps have no runtime value in the image.
+    # Maps under /app/bundle/programs/server/{app,packages,node_modules/meteor}
+    # are loaded by Meteor's source-map-support at boot, so they are kept.
+    && find /app/bundle/programs/server/npm/node_modules -type f -name '*.map' -delete \
+    && find /app/bundle/programs/web.browser -type f -name '*.map' -delete \
+    # The bundle carries build/Release output compiled on the glibc CI host.
+    # node-gyp-build prefers it over prebuilds/, so that binary shadows the musl
+    # one shipped in the same package and fails to load at runtime.
+    && STALE_BUILDS="$(find /app/bundle/programs/server/npm/node_modules -type d -name prebuilds)" \
+    && for d in $STALE_BUILDS; do rm -rf "${d%/prebuilds}/build"; done
+
+FROM node:24.15.0-alpine3.23 AS release-standard
+
+LABEL maintainer="buildmaster@rocket.chat"
+
+ENV LANG=C.UTF-8
+
+# `nogroup` group is historically reserved for NFS.
+# We don't use any NFS related tools in this image.
+# For the same reason of NFS using the gid, we can also use it as long as there are no conflicts in terms of running processes with the same egid (which is 1 in our case).
+# While 65533 raw gid could be used, renaming nogroup to rocketchat here for maximum compatibility with older debian image.
+# More info on nobody/nogroup - https://wiki.ubuntu.com/nobody
+# Debian wiki - https://wiki.debian.org/SystemGroups
+# """
+# daemon: Some unprivileged daemons that need to write to files on disk run as daemon.daemon (e.g., portmap, atd, probably others).
+# Daemons that don't need to own any files can run as nobody.nogroup instead,
+# and more complex or security conscious daemons run as dedicated users.
+# The daemon user is also handy for locally installed daemons.
+# """
+RUN apk add --no-cache shadow deno ttf-dejavu \
+    # Update OpenSSL
+    # CVE -> https://scout.docker.com/vulnerabilities/id/CVE-2025-9230?s=alpine&n=openssl&ns=alpine&t=apk&osn=alpine&osv=3.22
+    && apk upgrade --no-cache openssl \
+    && groupmod -n rocketchat nogroup \
+    && useradd -u 65533 -r -g rocketchat rocketchat
+
+# needs a mongo instance - defaults to container linking with alias 'mongo'
+ENV DEPLOY_METHOD=docker \
+    NODE_ENV=production \
+    MONGO_URL=mongodb://mongo:27017/rocketchat \
+    HOME=/tmp \
+    PORT=3000 \
+    ROOT_URL=http://localhost:3000 \
+    Accounts_AvatarStorePath=/app/uploads
+
+USER rocketchat
+
+COPY --from=builder --chown=rocketchat:rocketchat /app /app
+
+VOLUME /app/uploads
+
+WORKDIR /app/bundle
+
+EXPOSE 3000
+
+CMD ["node", "main.js"]
+
+FROM rocketchat/dhi-node:24.15.0-alpine3.23-fips AS release-fips
+
+LABEL maintainer="buildmaster@rocket.chat"
+
+# needs a mongo instance - defaults to container linking with alias 'mongo'
+ENV DEPLOY_METHOD=docker \
+    NODE_ENV=production \
+    MONGO_URL=mongodb://mongo:27017/rocketchat \
+    HOME=/tmp \
+    PORT=3000 \
+    ROOT_URL=http://localhost:3000 \
+    Accounts_AvatarStorePath=/app/uploads \
+    APPS_ENGINE_RUNTIME_BACKEND=node
+
+# the hardened image has no /etc/alpine-release, so node-gyp-build would detect
+# glibc and load the wrong prebuild for native modules
+ENV LIBC=musl
+
+USER node
+
+COPY --from=builder --chown=node:node /app /app
+
+VOLUME /app/uploads
+
+WORKDIR /app/bundle
+
+EXPOSE 3000
+
+CMD ["node", "--force-fips", "main.js"]

apps/meteor/.docker/Dockerfile.debian

@@ -0,0 +1,71 @@
+ARG DENO_VERSION="1.37.1"
+
+FROM denoland/deno:bin-${DENO_VERSION} as deno
+
+FROM node:24.15.0-bullseye-slim
+
+LABEL maintainer="buildmaster@rocket.chat"
+
+# dependencies
+RUN groupadd -g 65533 -r rocketchat \
+    && useradd -u 65533 -r -g rocketchat rocketchat \
+    && mkdir -p /app/uploads \
+    && chown rocketchat:rocketchat /app/uploads \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends fontconfig
+
+COPY --from=deno /deno /bin/deno
+
+# --chown requires Docker 17.12 and works only on Linux
+ADD --chown=rocketchat:rocketchat . /app
+
+# needs a mongoinstance - defaults to container linking with alias 'mongo'
+ENV DEPLOY_METHOD=docker \
+    NODE_ENV=production \
+    MONGO_URL=mongodb://mongo:27017/rocketchat \
+    HOME=/tmp \
+    PORT=3000 \
+    ROOT_URL=http://localhost:3000 \
+    Accounts_AvatarStorePath=/app/uploads
+
+RUN aptMark="$(apt-mark showmanual)" \
+    && apt-get install -y --no-install-recommends g++ make python3 ca-certificates \
+    && apt-mark auto '.*' > /dev/null \
+    && apt-mark manual $aptMark > /dev/null
+
+USER rocketchat
+
+RUN cd /app/bundle/programs/server \
+    && npm install --omit=dev \
+    && cd npm/node_modules/isolated-vm \
+    && npm install --omit=dev \
+    && npm cache clear --force \
+    # Drop sourcemaps from third-party prod deps and the client bundle:
+    #   - server/npm/node_modules: .map files shipped inside packages
+    #     (openpgp, date-fns, etc.). Node does not read them at runtime.
+    #   - web.browser: client-side bundle, maps have no runtime value in the image.
+    # Maps under /app/bundle/programs/server/{app,packages,node_modules/meteor}
+    # are loaded by Meteor's source-map-support at boot, so they are kept.
+    && find /app/bundle/programs/server/npm/node_modules -type f -name '*.map' -delete \
+    && find /app/bundle/programs/web.browser -type f -name '*.map' -delete
+
+USER root
+
+RUN find /usr/local -type f -executable -exec ldd '{}' ';' \
+    | awk '/=>/ { print $(NF-1) }' \
+    | sort -u \
+    | xargs -r dpkg-query --search \
+    | cut -d: -f1 \
+    | sort -u \
+    | xargs -r apt-mark manual \
+    && apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+
+USER rocketchat
+
+VOLUME /app/uploads
+
+WORKDIR /app/bundle
+
+EXPOSE 3000
+
+CMD ["node", "main.js"]

apps/meteor/.docker/licenses/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2015-2022 Rocket.Chat Technologies Corp.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+