chore(docker): remove npm from node runtime image to drop bundled-dep…

[jamcalli]

… CVEs

Description

Related Issues

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Performance improvement
• Code refactoring
• Documentation update
• Dependency update

Testing Performed

Screenshots

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• My changes work with existing functionality

Summary by CodeRabbit

• Chores
  • Reduced Docker runtime image size by streamlining the base image configuration.

[coderabbitai]

Walkthrough

The PR adds a cleanup step in the runtime stage of dockerfile.node to remove globally installed npm, npx, and corepack binaries from the base Node image, keeping the final container focused on node execution and vendored production dependencies.

Changes

Node Runtime Image Optimization

Layer / File(s)	Summary
Remove npm/npx/corepack from runtime image dockerfile.node	A documented RUN command in the runtime stage deletes globally installed npm, npx, and corepack artifacts, reducing final container size and removing unnecessary toolchain files.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• jamcalli/Pulsarr#1022: Modifies dockerfile.node runtime stage to install tini and update ENTRYPOINT, complementing this PR's cleanup of global npm/npx/corepack artifacts.
• jamcalli/Pulsarr#960: Introduced the Node-specific dockerfile.node runtime stage structure that this PR now refines by removing global toolchain binaries.

Suggested labels

chore

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: removing npm from the Node runtime image to address CVEs, which directly aligns with the dockerfile.node modifications.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/strip-npm-from-node-image

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}