fix: Dockerfile to reduce vulnerabilities (#260)

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314623
- https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314624
- https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314624
- https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314641
- https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314643

Dockerfile

@@ -1,4 +1,4 @@
-FROM --platform=linux/amd64 node:18.12.1-alpine3.16 as base
+FROM --platform=linux/amd64 node:18-alpine3.16 as base
 
 RUN apk --update --no-cache add --virtual .builds-deps build-base python3
 

app.js

@@ -106,16 +106,25 @@ const disconnect = () => {
   });
 };
 
-process.on('SIGUSR2', handle);
 process.on('SIGTERM', handle);
 
 function handle(signal) {
   const {removeFromSet} = srf.locals.dbHelpers;
-  const setName = `${(process.env.JAMBONES_CLUSTER_ID || 'default')}:active-fs`;
-  logger.info(`got signal ${signal}, removing ${srf.locals.localSipAddress} from set ${setName}`);
-  removeFromSet(setName, srf.locals.localSipAddress);
-  removeFromSet(FS_UUID_SET_NAME, srf.locals.fsUUID);
   srf.locals.disabled = true;
+  logger.info(`got signal ${signal}`);
+  const setName = `${(process.env.JAMBONES_CLUSTER_ID || 'default')}:active-fs`;
+  if (setName && srf.locals.localSipAddress) {
+    logger.info(`got signal ${signal}, removing ${srf.locals.localSipAddress} from set ${setName}`);
+    removeFromSet(setName, srf.locals.localSipAddress);
+  }
+  removeFromSet(FS_UUID_SET_NAME, srf.locals.fsUUID);
+  if (process.env.K8S) {
+    srf.locals.lifecycleEmitter.operationalState = LifeCycleEvents.ScaleIn;
+  }
+  if (getCount() === 0) {
+    logger.info('no calls in progress, exiting');
+    process.exit(0);
+  }
 }
 
 if (process.env.JAMBONZ_CLEANUP_INTERVAL_MINS) {

lib/utils/http-requestor.js

@@ -2,7 +2,6 @@ const {Client, Pool} = require('undici');
 const parseUrl = require('parse-url');
 const assert = require('assert');
 const BaseRequestor = require('./base-requestor');
-const WsRequestor = require('./ws-requestor');
 const {HookMsgTypes} = require('./constants.json');
 const snakeCaseKeys = require('./snakecase-keys');
 const pools = new Map();
@@ -94,6 +93,7 @@ class HttpRequestor extends BaseRequestor {
 
     /* if we have an absolute url, and it is ws then do a websocket connection */
     if (this._isAbsoluteUrl(url) && url.startsWith('ws')) {
+      const WsRequestor = require('./ws-requestor');
       this.logger.debug({hook}, 'HttpRequestor: switching to websocket connection');
       const h = typeof hook === 'object' ? hook : {url: hook};
       const requestor = new WsRequestor(this.logger, this.account_sid, h, this.secret);

lib/utils/sbc-pinger.js

@@ -75,6 +75,10 @@ module.exports = (logger) => {
       }
     })();
   }
+  else if (process.env.K8S) {
+    lifecycleEmitter.scaleIn = () => process.exit(0);
+  }
+
 
   async function pingProxies(srf) {
     if (process.env.NODE_ENV === 'test') return;

lib/utils/ws-requestor.js

@@ -4,7 +4,6 @@ const short = require('short-uuid');
 const {HookMsgTypes} = require('./constants.json');
 const Websocket = require('ws');
 const snakeCaseKeys = require('./snakecase-keys');
-const HttpRequestor = require('./http-requestor');
 const MAX_RECONNECTS = 5;
 const RESPONSE_TIMEOUT_MS = process.env.JAMBONES_WS_API_MSG_RESPONSE_TIMEOUT || 5000;
 
@@ -53,6 +52,7 @@ class WsRequestor extends BaseRequestor {
 
     /* if we have an absolute url, and it is http then do a standard webhook */
     if (this._isAbsoluteUrl(url) && url.startsWith('http')) {
+      const HttpRequestor = require('./http-requestor');
       this.logger.debug({hook}, 'WsRequestor: sending a webhook (HTTP)');
       const h = typeof hook === 'object' ? hook : {url: hook};
       const requestor = new HttpRequestor(this.logger, this.account_sid, h, this.secret);