Address Docker security and best practices from PR review

client/.dockerignore

@@ -2,7 +2,6 @@
 node_modules
 npm-debug.log
 yarn-error.log
-package-lock.json
 yarn.lock
 
 # Build output

client/nginx.conf

@@ -16,6 +16,7 @@ server {
   add_header X-Frame-Options "SAMEORIGIN" always;
   add_header X-Content-Type-Options "nosniff" always;
   add_header X-XSS-Protection "1; mode=block" always;
+  add_header Referrer-Policy "strict-origin-when-cross-origin" always;
 
   # Handle React Router
   location / {

docker-compose.yaml

@@ -9,12 +9,10 @@ services:
       - '5173:5173'
     env_file:
       - ./client/.env
-    environment:
-      - VITE_SERVER_DOMAIN=http://localhost:8000
     volumes:
       - ./client/src:/app/src
       - ./client/public:/app/public
-      - /app/node_modules
+      - client_node_modules:/app/node_modules
     depends_on:
       - server
     restart: unless-stopped
@@ -30,7 +28,8 @@ services:
     ports:
       - '8000:8000'
     depends_on:
-      - mongo
+      mongo:
+        condition: service_healthy
     env_file:
       - ./server/.env
     environment:
@@ -40,17 +39,29 @@ services:
       - ./server/src:/app/src
       - ./server/logs:/app/logs
     restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8000/monitor/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
     networks:
       - code-a2z-network
 
   mongo:
-    image: mongo:8.2.2-noble
+    image: mongo:7-noble
     container_name: code-a2z-mongo
     ports:
       - '27017:27017'
     volumes:
       - mongo-data:/data/db
     restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "mongosh", "--eval", "db.adminCommand('ping')"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
     networks:
       - code-a2z-network
 
@@ -61,8 +72,8 @@ services:
       - '8081:8081'
     environment:
       - ME_CONFIG_MONGODB_URL=mongodb://mongo:27017
-      - ME_CONFIG_BASICAUTH_USERNAME=admin
-      - ME_CONFIG_BASICAUTH_PASSWORD=admin123
+      - ME_CONFIG_BASICAUTH_USERNAME=${MONGO_EXPRESS_USER:-admin}
+      - ME_CONFIG_BASICAUTH_PASSWORD=${MONGO_EXPRESS_PASSWORD:-changeme}
       - ME_CONFIG_MONGODB_ENABLE_ADMIN=true
     depends_on:
       - mongo
@@ -72,6 +83,7 @@ services:
 
 volumes:
   mongo-data:
+  client_node_modules:
 
 networks:
   code-a2z-network:

docs/DOCKER.md

@@ -748,10 +748,10 @@ sudo chown -R $USER:$USER .
 
 ```bash
 # Clear Docker cache and rebuild
-docker-compose -f docker-compose.fullstack.yaml build --no-cache
+docker-compose build --no-cache
 
 # Remove all containers and images
-docker-compose -f docker-compose.fullstack.yaml down
+docker-compose down
 docker system prune -a
 ```
 

server/.dockerignore

@@ -2,7 +2,6 @@
 node_modules
 npm-debug.log
 yarn-error.log
-package-lock.json
 yarn.lock
 
 # Environment variables
@@ -37,6 +36,7 @@ Thumbs.db
 
 # Docker
 Dockerfile
+docker-compose*.yml
 docker-compose*.yaml
 .dockerignore
 

server/.env.example

@@ -7,6 +7,10 @@ VITE_CLIENT_DOMAIN=https://code-a2z.vercel.app
 # Database Configuration
 MONGODB_URL=mongodb://localhost:27017/code-a2z
 
+# Mongo Express Configuration (for Docker only)
+MONGO_EXPRESS_USER=admin
+MONGO_EXPRESS_PASSWORD=changeme
+
 # Authentication Configuration
 JWT_SECRET_ACCESS_KEY=
 JWT_ACCESS_EXPIRES_IN=15m

server/Dockerfile

@@ -29,7 +29,7 @@ WORKDIR /app
 COPY package*.json ./
 
 # Install only production dependencies
-RUN npm ci --only=production
+RUN npm ci --omit=dev
 
 # Copy source code
 COPY . .

server/docker-compose.yaml

@@ -21,7 +21,7 @@ services:
       - code-a2z-network
 
   mongo:
-    image: mongo:8.2.2-noble
+    image: mongo:7-noble
     container_name: code-a2z-mongo
     ports:
       - '27017:27017'
@@ -38,8 +38,8 @@ services:
       - '8081:8081'
     environment:
       - ME_CONFIG_MONGODB_URL=mongodb://mongo:27017
-      - ME_CONFIG_BASICAUTH_USERNAME=admin
-      - ME_CONFIG_BASICAUTH_PASSWORD=admin123
+      - ME_CONFIG_BASICAUTH_USERNAME=${MONGO_EXPRESS_USER:-admin}
+      - ME_CONFIG_BASICAUTH_PASSWORD=${MONGO_EXPRESS_PASSWORD:-changeme}
       - ME_CONFIG_MONGODB_ENABLE_ADMIN=true
     depends_on:
       - mongo