feat(mbe, ebe): dockerize mbe/ebe

[mohammadalfaiyazbitgo]

Ticket: WP-4681

[pranavjain97]

We should have different dockerfiles for both the apps to keep the dependencies limited to their app. Enclaved express should have a very light dockerfile.

Also, please lets add a docker-compose to ease up local dev, but you can do it in a follow-up.

[pranavjain97]

why is this being hardcoded to production?

[mohammadalfaiyazbitgo]

We should have different dockerfiles for both the apps to keep the dependencies limited to their app. Enclaved express should have a very light dockerfile.

Also, please lets add a docker-compose to ease up local dev, but you can do it in a follow-up.

They have the same dependencies, they only difference I can see is that they expose different ports

[Copilot]

Pull Request Overview

Adds Docker and Podman support for both Master Express and Enclaved Express, including container build scripts, self-signed certificates, and updated health endpoint handling.

• Introduce Dockerfile and .dockerignore for multi-stage container build
• Add self-signed test and enclaved certificates into certs/ for mTLS
• Update health router to map response.body.status and timestamp instead of raw body
• Extend package.json scripts and README.md with Podman container instructions

Reviewed Changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/masterBitgoExpress/routers/enclavedExpressHealth.ts	Map enclaved response shape and update io-ts type
package.json	Add container:build script to build Podman image
certs/test-ssl-key.pem	Add self-signed private key for Master Express
certs/test-ssl-cert.pem	Add self-signed certificate for Master Express
certs/enclaved-express-key.pem	Add private key for Enclaved Express
certs/enclaved-express-cert.pem	Add certificate for Enclaved Express
README.md	Document Podman container build and run commands
Dockerfile	Define multi-stage Dockerfile for build & production
.dockerignore	Exclude unnecessary files from Docker build context

Comments suppressed due to low confidence (3)

README.md:180

• [nitpick] When passing build arguments via Yarn scripts, you need to separate flags with --, e.g., yarn container:build -- --build-arg PORT=3080.

yarn container:build --build-arg PORT=3080

src/masterBitgoExpress/routers/enclavedExpressHealth.ts:14

• [nitpick] Rather than leaving a TODO, consider extracting this common response type into a shared module now to avoid duplication and drift between services.

// TODO: Move to common definition between enclavedExpress and masterExpress

src/masterBitgoExpress/routers/enclavedExpressHealth.ts:81

• [nitpick] The mapping from response.body to the new enclavedResponse shape hasn't been covered by tests. Please add or update tests to verify the status and timestamp are propagated correctly.

enclavedResponse: {

[Copilot]

The production stage uses ENV NODE_ENV={NODE_ENV} which will literally set the value to {NODE_ENV}. It should use ENV NODE_ENV=${NODE_ENV} to interpolate the build argument correctly.

Suggested change

	ENV NODE_ENV={NODE_ENV} \
	ENV NODE_ENV=${NODE_ENV} \

[Copilot]

The PORT build argument isn't declared or exported in the production stage, so EXPOSE ${PORT} may not work as expected. Consider adding ARG PORT and ENV PORT=${PORT} in the production stage.

[Copilot]

Committing private keys into the repository can lead to security risks. Consider generating these keys at build or runtime, or storing them in a secure secrets store instead of version control.

[Copilot]

This private key is also committed to version control. For security, keys should be generated or injected at runtime rather than stored in the repo.