Pin to node:18-alpine — node:latest is Node 26 and breaks yargs ESM - #98
Open
jacksonkyle wants to merge 4 commits into
Open
Pin to node:18-alpine — node:latest is Node 26 and breaks yargs ESM#98jacksonkyle wants to merge 4 commits into
jacksonkyle wants to merge 4 commits into
Conversation
Latest Node tag is currently Node 26.x. yargs (a dependency in this
tree) loads its CJS entrypoint via require() from a file Node 26
treats as an ES module:
ReferenceError: require is not defined in ES module scope, you can
use import instead
at file:///node_modules/yargs/yargs:3:69
Node 18 LTS doesn't reproduce. Pinning to the version range mcguinness
upstream actually tests against.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
npm install fails on Alpine because the samlp dependency is declared as `github:mcguinness/node-samlp` and npm spawns git to clone it. node:18-alpine doesn't ship git, so we get ENOENT for `git`. apk add no-cache git satisfies the install step. Image size grows by ~30 MB which is fine for a test IdP. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Two issues with the previous Dockerfile: 1. Default --host is "localhost" inside the container — that's the container's loopback, so Traefik (in a different container) can't reach the IdP and routing fails. Force --host 0.0.0.0. 2. ENTRYPOINT had hardcoded Okta placeholder --acs/--aud values. They override any env var Dokploy passes, so the IdP always issued assertions for the placeholder audience and the SP rejected them. Move to an entrypoint script that translates SAML_ACS_URL / SAML_AUDIENCE / SAML_SLO_URL / SAML_ISSUER env vars into the matching CLI flags. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The root-level `saml-idp:` key is the legacy Compose v1 schema and
modern Docker Compose validation rejects it with
"additional properties 'saml-idp' not allowed". Wrap in `services:`.
Also:
- Drop `net: host`, which doesn't fit Dokploy's reverse-proxy
networking model. Traefik routes via the project's docker
network instead.
- `expose` instead of `ports` so the IdP is reachable from sibling
containers / Traefik but not published on the host.
- Wire SAML_* env vars through so they reach the entrypoint.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Latest Node tag is currently Node 26.x. yargs (a dependency in this tree) loads its CJS entrypoint via require() from a file Node 26 treats as an ES module:
ReferenceError: require is not defined in ES module scope, you can
use import instead
at file:///node_modules/yargs/yargs:3:69
Node 18 LTS doesn't reproduce. Pinning to the version range mcguinness upstream actually tests against.