Build CubeJS container on AmazonLinux 2023 (or really any RHEL) + FIPS monkeypatch

Dockerfile

ARG BUILD_SCOPE=minimal
ARG INSTALL_TYPE=fips

ARG CUBEJS_REPO=cubejs/cube
ARG CUBEJS_VERSION=v1.6.20

ARG NODE_VERSION=22
ARG YARN_VERSION=1.22.22

#### cube source
FROM ${CUBEJS_REPO}:${CUBEJS_VERSION} AS vendor-cube

#### os
FROM public.ecr.aws/amazonlinux/amazonlinux:2023 AS os
RUN <<EOD
ulimit -n 1024
dnf install -y \
  --setopt=install_weak_deps=False \
  crypto-policies-scripts
update-crypto-policies --set FIPS
EOD

#### standard sysroot for the final layer
FROM os AS sysroot
ARG NODE_VERSION
WORKDIR /root
SHELL ["/bin/bash", "-e", "-o", "nounset", "-o", "pipefail", "-c"]

# initialize and setup crypto policy
# and install any packages needed at runtime
RUN <<EOD
mkdir /sysroot
ulimit -n 1024
# crypto policy
dnf install -y \
  --setopt=install_weak_deps=False \
  --installroot /sysroot \
  --releasever=$(rpm -q system-release --qf '%{VERSION}') \
  crypto-policies-scripts \
  nodejs${NODE_VERSION} \
  python3.11
chroot /sysroot update-crypto-policies --set FIPS
dnf -y --installroot /sysroot remove crypto-policies-scripts
EOD

#### build environment
FROM os AS build-base

ARG NODE_VERSION
ARG YARN_VERSION
ARG CUBEJS_REPO
ARG CUBEJS_VERSION
ENV TZ=Etc/UTC
ENV NODE_ENV=production
SHELL ["/bin/bash", "-e", "-o", "nounset", "-o", "pipefail", "-c"]

RUN <<EOD
dnf install -y --setopt=install_weak_deps=False \
  nodejs${NODE_VERSION}-npm \
  python3.11-devel \
  tar gzip
npm install --global yarn@${YARN_VERSION}
yarn policies set-version v${YARN_VERSION}
yarn config set network-timeout 120000 -g
echo -n "node: " ; node --version
echo -n "npm: " ; npm --version
echo -n "yarn: " ; yarn --version
EOD

#### build cube
FROM build-base AS builder

WORKDIR /cube

RUN <<EOF
curl -fsSL "https://github.com/cube-js/cube/archive/refs/tags/${CUBEJS_VERSION}.tar.gz" -o /tmp/cube-src.tar.gz
tar --strip-components=3 --wildcards -xf /tmp/cube-src.tar.gz -- */packages/cubejs-docker
rm /tmp/cube-src.tar.gz
EOF

COPY --from=vendor-cube /cube/yarn.lock yarn.lock
COPY --from-vendor-cube /cube/package.json package.json

RUN --mount=type=cache,target=/root/.cache/yarn/v6,sharing=locked <<EOF
yarn install --non-interactive --prod
EOF

RUN <<EOD
ln -s /cube/node_modules/.bin/cubejs /usr/local/bin/cubejs
ln -s /cube/node_modules/.bin/cubestore-dev /usr/local/bin/cubestore-dev
EOD

####
FROM sysroot AS sysroot-minimal

COPY --from=builder /cube /sysroot/cube
COPY --from=builder /usr/local/bin /sysroot/usr/local/bin

####
FROM scratch AS install-minimal
COPY --from=sysroot-minimal /sysroot /

FROM builder AS install-developer

#### FIPS final image
FROM install-${BUILD_SCOPE} AS installfips

ENV TZ=Etc/UTC
ENV NODE_ENV=production
ENV NODE_PATH=/cube/conf/node_modules:/cube/node_modules

WORKDIR /cube/node_modules/cubejs-cli/dist/src
# monkey patch to enable FIPS support
RUN <<EOF
echo "Node default Ciphers: `node  -e 'console.log(crypto.getCiphers().length)'`"
echo -n 'Node FIPS support: '
if node --enable-fips -e 'console.log(crypto.getFips())' ; then
  echo "Node FIPS Ciphers: `node --force-fips -e 'console.log(crypto.getCiphers().length)'`"
else
  echo >&2 "Node FIPS does not work!"
fi
cat >fips_patch.js <<EOD
const crypto = require('node:crypto');
function monkeyPatch() {
  const originalCreateHash = crypto.createHash;
  function createHashInterceptMD5(...argv) {
    if (argv[0] === 'md5') {
      argv[0] = 'sha1';
    }
    return originalCreateHash(...argv);
  }
  crypto.createHash = createHashInterceptMD5;
}
monkeyPatch();
EOD
sed -i 's@^#!/usr/bin/env node@#!/usr/bin/env -S node --force-fips@' index.js
sed -i "/^\"use strict\";/a require('.\/fips_patch.js');" index.js
EOF

#### standard final image
FROM install-${BUILD_SCOPE} AS install

####
FROM install${INSTALL_TYPE} AS final

ARG CUBEJS_VERSION
ARG YARN_VERSION
ARG IMAGE_VERSION=unknown

ENV CUBEJS_DOCKER_IMAGE_VERSION=$IMAGE_VERSION
ENV CUBEJS_DOCKER_IMAGE_TAG=$CUBEJS_VERSION
ENV NODE_ENV=production
ENV NODE_PATH=/cube/conf/node_modules:/cube/node_modules
ENV PYTHONUNBUFFERED=1
ENV TZ=Etc/UTC
ENV CUBEJS_SCHEMA_PATH=schema
ENV CUBEJS_CONCURRENCY=4
ENV PAGER=cat

WORKDIR /cube/conf
COPY /schema ./schema

EXPOSE 4000

COPY --from=ghcr.io/tarampampam/microcheck:1.3.0 /bin/httpcheck /bin/httpcheck
HEALTHCHECK --start-period=30s --start-interval=1s --interval=1m --timeout=10s \
  CMD ["/bin/httpcheck", "http://127.0.0.1:4000/readyz"]

CMD ["cubejs", "server"]