[MusaMisto]

Why

Official node:26 images no longer include Yarn (nodejs/docker-node#2407). Every image up to Node 24 does. Moving a Dockerfile here to Node 26 would fail at the first yarn command with yarn: not found. That already happened in another repo on 2026-11-03.

What

Every build stage that runs yarn now starts, right after its FROM, with:

RUN command -v yarn >/dev/null || npm install -g yarn@1.22.22

• On the current base image it does nothing. The image already has Yarn, which stays exactly as it is.
• On node:26 it installs Yarn 1.22.22, the final Yarn 1 release.
• It sits straight after FROM, so it runs as root before any USER line.
• A plain npm install -g yarn would fail on the current images, because Yarn is already installed. That's why the line checks first.
• Renovate keeps the pinned version current, within Yarn 1.

Proof

• Dockerfile: 1 stage(s) patched; buildx --check before [none], after [none]

• Lint: the docker buildx build --check findings listed are the same before and after this change. Any finding there was already in the file.

• The images in use ship Yarn: the official Node images from 14 to 24, in every variant used across the org, ship Yarn 1.22.19 or 1.22.22 (checked with docker run). So this line is a no-op there.

• Full builds: the line was proven in full builds of the enrolled repos' Dockerfiles, and on node:26-alpine, where it installs Yarn 1.22.22.

[coderabbitai]

No actionable comments were generated in the recent review.

Summary

Summary

• The ui-build stage checks for yarn after FROM. If it is unavailable, the stage installs Yarn 1.22.22 globally with npm.
• The dependency installation and UI build commands are unchanged.

Risk level: risk:low

Security-sensitive areas: The change installs a pinned package globally during the container build. It does not change runtime permissions or application security settings.

Test coverage impact: No test results are supplied. The PR description reports Docker build checks and full builds for enrolled repositories’ Dockerfiles; those reports do not cover other stages or base images.

Operational concerns: The Dockerfile currently uses node:22-alpine. The conditional is intended to support base images without Yarn, such as node:26-alpine. No migration or rollback steps are indicated.

The ui-build stage now checks for Yarn and installs version 1.22.22 only when the yarn command is unavailable. The remaining dependency installation and UI build instructions are unchanged.

Changes: UI build Yarn setup

Layer / File(s)	Summary
Yarn availability check Dockerfile	The ui-build stage checks whether the yarn command is available. If it is unavailable, the stage installs Yarn 1.22.22.

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Possibly related PRs

• simplify9/Bitween-api#411: Adds a Yarn resolutions entry to the client package manifest, affecting the dependency-install path used by this Docker stage.

Suggested labels: infra, risk:high

Suggested reviewers: samerzughul

Merge Risk: Minimal · up to 42022

No actionable merge-blocking risk is identified in the conditional Yarn setup. Merge after normal build checks pass.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title names the primary change: a Docker build step that installs Yarn 1 when the base image lacks it, with the reason (node:26 images no longer include Yarn). The raw summary confirms the Dockerf…
Description check		The description explains the reason (official node:26 images drop Yarn), the change (a conditional yarn install right after each FROM in build stages that run yarn), expected behavior on current and n…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the primary change: a Docker build step that installs Yarn 1 when the base image lacks it, with the reason (node:26 images no longer include Yarn). The raw summary confirms the Dockerfile change: the ui-build stage installs yarn@1.22.22 only when yarn is missing. The title is concise, specific, and matches the changeset.

Full details: Description check

Explanation

The description explains the reason (official node:26 images drop Yarn), the change (a conditional yarn install right after each FROM in build stages that run yarn), expected behavior on current and node:26 images, and the verification performed. It matches the single Dockerfile change in the raw summary. The objectives note that the reported checks cover only some stages and base images, but this affects the strength of the evidence, not the relevance of the description.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML; Path: .coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 733a66c4-3d2e-4c2c-8432-543daecbdf2e

Commits

Reviewing files that changed from the base of the PR and between 5d6183d and 420224e.

Files selected for processing: 1

• Dockerfile

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Recent review details

Context from checks skipped due to timeout: 2

• GitHub Check: CodeRabbit
• GitHub Check: build-and-unit-test

Additional context used

Path-based instructions: 1

Review Dockerfiles for root user usage, unnecessary packages, unpinned base images, secret leakage, cache poisoning, excessive image size, and missing health checks.

CodeRabbit configuration file

Files:

• Dockerfile

Checkov (3.3.29)

Dockerfile

[low] 1-70: Ensure that HEALTHCHECK instructions have been added to container images

(CKV_DOCKER_2)