feat: migrate to node 22

Dockerfile

@@ -1,32 +1,44 @@
 # Use the official Node.js Debian image as the base image
-FROM node:18-bookworm-slim
+FROM node:22-bookworm-slim AS base
 
-# Set the working directory
-WORKDIR /usr/src/app
-
-# Install
 ENV CHROME_BIN="/usr/bin/chromium" \
     PUPPETEER_SKIP_CHROMIUM_DOWNLOAD="true" \
     NODE_ENV="production"
-RUN set -x \
-    && apt-get update \
-    && apt-get install -y --no-install-recommends \
-    fonts-freefont-ttf \
-    chromium \
-    ffmpeg \
-    && rm -rf /var/lib/apt/lists/*
 
-# Copy package.json and package-lock.json to the working directory
+WORKDIR /usr/src/app
+
+FROM base AS deps
+
 COPY package*.json ./
 
-# Install the dependencies
 RUN npm ci --only=production --ignore-scripts
 
-# Copy the rest of the source code to the working directory
-COPY . .
+# Create the final stage
+FROM base
+
+# Install system dependencies and create wwebjs user
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+    fonts-freefont-ttf \
+    chromium \
+    ffmpeg && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* && \
+    # Create wwebjs user and group with home directory
+    groupadd -r wwebjs && \
+    useradd -r -g wwebjs -m -d /home/wwebjs -s /bin/bash wwebjs && \
+    # Give ownership of the working directory to wwebjs user
+    chown -R wwebjs:wwebjs /usr/src/app
+
+# Copy only production dependencies from deps stage
+COPY --from=deps /usr/src/app/node_modules ./node_modules
+
+# Copy application code
+COPY --chown=wwebjs:wwebjs . .
 
-# Expose the port the API will run on
 EXPOSE 3000
 
-# Start the API
-CMD ["npm", "start"]
+# Use wwebjs user for better security
+USER wwebjs
+
+CMD ["npm", "start"]