docker

No clear indicators of intentional malware are present in the provided Docker/Compose fragments. The primary security concern is build-time supply-chain trust: executing a network-fetched installer via `curl ... | sh` during the builder stage, which could allow malicious toolchain installation if the installer source/content is compromised or not integrity-pinned. Additional moderate risks include non-digest-pinned base images/tags and a nonstandard Node runtime entrypoint (`node build`) that should be verified for correctness and stability.