patrick
b70ed5cb51
Tagging v* builds both images on Gitea Actions and pushes them to the instance registry, then smoke-tests the published stack. The frontend read its backend URL through import.meta.env, which Vite resolves at build time, so an image could only point at whatever the build host had; it now reads it at runtime.
63 lines
1.3 KiB
Docker
63 lines
1.3 KiB
Docker
FROM node:24-slim AS base
|
|
|
|
ENV PNPM_HOME="/pnpm"
|
|
ENV PATH="$PNPM_HOME:$PATH"
|
|
|
|
RUN corepack enable
|
|
|
|
WORKDIR /app
|
|
|
|
|
|
|
|
FROM base AS prod-deps
|
|
|
|
# pnpm-workspace.yaml carries onlyBuiltDependencies; without it pnpm blocks the postinstall
|
|
# scripts it lists, so the install here would not match a local one.
|
|
COPY pnpm-lock.yaml pnpm-workspace.yaml ./
|
|
|
|
RUN --mount=type=cache,target=/pnpm/store \
|
|
pnpm fetch --frozen-lockfile
|
|
|
|
COPY package.json ./
|
|
|
|
RUN --mount=type=cache,target=/pnpm/store \
|
|
pnpm install --frozen-lockfile --prod --offline
|
|
|
|
|
|
|
|
FROM base AS build
|
|
|
|
COPY pnpm-lock.yaml pnpm-workspace.yaml package.json ./
|
|
|
|
RUN --mount=type=cache,target=/pnpm/store \
|
|
pnpm install --frozen-lockfile
|
|
|
|
COPY . .
|
|
|
|
RUN pnpm run build
|
|
|
|
|
|
|
|
FROM node:24-slim
|
|
|
|
# Setup a non-root user
|
|
RUN groupadd -g 9999 appuser && \
|
|
useradd -u 9999 -g appuser -m -d /app -s /sbin/nologin appuser
|
|
|
|
COPY --from=prod-deps --chown=appuser:appuser /app/node_modules /app/node_modules
|
|
COPY --from=build --chown=appuser:appuser /app/build /app/build
|
|
|
|
USER appuser
|
|
|
|
ENV ORIGIN=http://localhost:3000
|
|
ENV BODY_SIZE_LIMIT=2G
|
|
|
|
EXPOSE 3000
|
|
|
|
WORKDIR /app
|
|
|
|
HEALTHCHECK --interval=10s --timeout=3s --retries=5 --start-period=10s \
|
|
CMD ["node", "-e", "fetch(`http://127.0.0.1:${process.env.PORT || 3000}/login`).then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]
|
|
|
|
CMD [ "node", "build" ]
|