a226cbddbd
`docker compose build` without NEXUS_TOKEN produced a Nexus 401 forty seconds in, worded as a credentials problem when it was really an unset variable. The mount's `required=true` asserts the secret was *declared*, not that it holds anything, so an empty one sailed past it and npm sent an empty `_authToken`. The install moves to tools/docker-install-deps.sh, which checks the secret before touching the network and fails in under a second with the three ways to supply it. It is a file rather than inline shell because BuildKit echoes an inline command twice on failure and buries the message. Also ignore .env. It carries NEXUS_TOKEN, compose reads it at build time, and it was not gitignored — .env.example stays tracked. Nothing had been committed: the only prior commit predates all of this. Verified: empty token fails in 0.2s with the message; .env and the environment variable both build; the image carries no trace of the token and serves the full page. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
61 lines
2.1 KiB
Docker
61 lines
2.1 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Build
|
|
#
|
|
# Nx and the Angular compiler need the whole workspace, so this stage is heavy
|
|
# and is thrown away: only `dist/landing/analog` crosses into the runtime image.
|
|
# ---------------------------------------------------------------------------
|
|
FROM node:22-alpine AS build
|
|
|
|
WORKDIR /app
|
|
|
|
ENV NX_DAEMON=false \
|
|
CI=true \
|
|
PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
|
|
|
|
# Manifests first, so a source-only change does not reinstall the world.
|
|
COPY package.json package-lock.json .npmrc ./
|
|
|
|
# `@pi/ui` comes from the private Nexus, so the install needs a token — passed
|
|
# as a BuildKit secret rather than a build ARG, which would be readable forever
|
|
# in the image history. The script checks the secret actually holds something
|
|
# before spending four minutes finding out from Nexus.
|
|
COPY tools/docker-install-deps.sh ./tools/
|
|
|
|
RUN --mount=type=secret,id=nexus_token,required=true \
|
|
sh tools/docker-install-deps.sh
|
|
|
|
COPY nx.json tsconfig.base.json eslint.config.mjs ./
|
|
COPY landing ./landing
|
|
|
|
RUN npx nx build landing
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Runtime
|
|
#
|
|
# Nitro vendors its own dependencies into the build output, so there is nothing
|
|
# to install here: the whole server is the 17 MB it copies.
|
|
# ---------------------------------------------------------------------------
|
|
FROM node:22-alpine AS runtime
|
|
|
|
WORKDIR /app
|
|
|
|
ENV NODE_ENV=production \
|
|
PORT=3000 \
|
|
HOST=0.0.0.0
|
|
|
|
# `node` already exists in the base image, unprivileged and with no shell login.
|
|
COPY --from=build --chown=node:node /app/dist/landing/analog ./analog
|
|
|
|
USER node
|
|
|
|
EXPOSE 3000
|
|
|
|
# Node rather than curl or wget: neither is in the base image, and adding one
|
|
# for a health check is a package more than the job needs.
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
|
|
CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
|
|
|
|
CMD ["node", "analog/server/index.mjs"]
|