63 lines
2.2 KiB
Docker
63 lines
2.2 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Build
|
|
#
|
|
# Nx and the Angular compiler need the whole workspace, so this stage is heavy
|
|
# and is thrown away: only `dist/landing/analog` crosses into the runtime image.
|
|
# ---------------------------------------------------------------------------
|
|
FROM node:22-alpine AS build
|
|
|
|
WORKDIR /app
|
|
|
|
ENV NX_DAEMON=false \
|
|
CI=true \
|
|
PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
|
|
|
|
# Manifests first, so a source-only change does not reinstall the world.
|
|
COPY package.json package-lock.json .npmrc ./
|
|
|
|
# `@pi/ui` comes from the private Nexus, so the install needs a token — passed
|
|
# as a BuildKit secret rather than a build ARG, which would be readable forever
|
|
# in the image history. The npmrc it lands in is written and removed inside one
|
|
# layer, so it leaves no trace even in this discarded stage.
|
|
RUN --mount=type=secret,id=nexus_token,required=true \
|
|
sh -eu -c '\
|
|
printf "//nexus.pireon.dev/repository/npm-releases/:_authToken=%s\n" \
|
|
"$(cat /run/secrets/nexus_token)" > /tmp/npmrc; \
|
|
NPM_CONFIG_USERCONFIG=/tmp/npmrc npm ci --no-audit --no-fund; \
|
|
rm -f /tmp/npmrc'
|
|
|
|
COPY nx.json tsconfig.base.json eslint.config.mjs ./
|
|
COPY landing ./landing
|
|
|
|
RUN npx nx build landing
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Runtime
|
|
#
|
|
# Nitro vendors its own dependencies into the build output, so there is nothing
|
|
# to install here: the whole server is the 17 MB it copies.
|
|
# ---------------------------------------------------------------------------
|
|
FROM node:22-alpine AS runtime
|
|
|
|
WORKDIR /app
|
|
|
|
ENV NODE_ENV=production \
|
|
PORT=3000 \
|
|
HOST=0.0.0.0
|
|
|
|
# `node` already exists in the base image, unprivileged and with no shell login.
|
|
COPY --from=build --chown=node:node /app/dist/landing/analog ./analog
|
|
|
|
USER node
|
|
|
|
EXPOSE 3000
|
|
|
|
# Node rather than curl or wget: neither is in the base image, and adding one
|
|
# for a health check is a package more than the job needs.
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
|
|
CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
|
|
|
|
CMD ["node", "analog/server/index.mjs"]
|