-
-
Notifications
You must be signed in to change notification settings - Fork 113
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into dependabot/github_actions/docker/setup-build…
…x-action-3.9.0
- Loading branch information
Showing
7 changed files
with
495 additions
and
714 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| 20.18.1 | ||
| 22 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,55 +1,72 @@ | ||
| FROM node:20.18.1-alpine3.19 AS build | ||
| ARG PNPM_VERSION=9.15.5 | ||
| ARG NODE_VERSION=20.13.1-alpine3.19 | ||
|
|
||
| # set app basepath | ||
| ENV HOME=/home/app | ||
| FROM node:${NODE_VERSION} AS build | ||
|
|
||
| # add app dependencies | ||
| COPY package.json $HOME/node/ | ||
| COPY pnpm-lock.yaml $HOME/node/ | ||
| # Use a more specific working directory | ||
| ENV HOME=/opt/app | ||
|
|
||
| # change working dir and install deps | ||
| WORKDIR $HOME/node | ||
| # Create non-root user early in build stage | ||
| RUN addgroup -g 101 app && adduser -u 100 -D -G app -s /bin/false app | ||
|
|
||
| # Set ownership and permissions | ||
| WORKDIR $HOME | ||
| RUN chown app:app $HOME | ||
|
|
||
| # Install pnpm globally before switching to non-root user | ||
| USER root | ||
| RUN npm install -g pnpm@${PNPM_VERSION} | ||
|
|
||
| # Switch to non-root user for remaining operations | ||
| USER app | ||
|
|
||
| # Add package files with specific ownership | ||
| COPY --chown=app:app package.json pnpm-lock.yaml ./ | ||
|
|
||
| # enable pnpm and install deps | ||
| RUN corepack enable | ||
| RUN pnpm --ignore-scripts --frozen-lockfile install | ||
| # Install dependencies | ||
| RUN pnpm install --frozen-lockfile --ignore-scripts | ||
|
|
||
| # copy all app files | ||
| COPY . $HOME/node/ | ||
| # Copy application code | ||
| COPY --chown=app:app . . | ||
|
|
||
| # compile typescript and build all production stuff | ||
| # Build application | ||
| RUN pnpm build:docker | ||
|
|
||
| # remove dev dependencies and files that are not needed in production | ||
| RUN rm -rf node_modules | ||
| RUN pnpm install --prod --frozen-lockfile --ignore-scripts | ||
| RUN rm -rf $PROJECT_WORKDIR/.pnpm-store | ||
| # Clean up development dependencies | ||
| RUN pnpm install --prod --frozen-lockfile --ignore-scripts && \ | ||
| rm -rf .pnpm-store | ||
|
|
||
| # start new image for lower size | ||
| FROM node:20.13.1-alpine3.19 | ||
| # Production image | ||
| FROM node:${NODE_VERSION} | ||
|
|
||
| # Update OpenSSL and install dumb-init | ||
| # Update system and install security packages | ||
| RUN apk update && \ | ||
| apk upgrade openssl && \ | ||
| apk add --no-cache dumb-init && \ | ||
| apk upgrade --no-cache && \ | ||
| apk add --no-cache dumb-init tini && \ | ||
| rm -rf /var/cache/apk/* | ||
|
|
||
| # create user with no permissions | ||
| # Create non-root user | ||
| RUN addgroup -g 101 app && adduser -u 100 -D -G app -s /bin/false app | ||
|
|
||
| # set app basepath | ||
| ENV HOME=/home/app | ||
| # Set up application directory | ||
| WORKDIR /opt/app | ||
|
|
||
| # copy production compiled node app to the new image | ||
| COPY --chown=app:app --from=build $HOME/node/ $HOME/node/ | ||
| # Copy only necessary files from build stage | ||
| COPY --chown=app:app --from=build /opt/app/dist ./dist | ||
| COPY --chown=app:app --from=build /opt/app/node_modules ./node_modules | ||
| COPY --chown=app:app --from=build /opt/app/package.json ./ | ||
|
|
||
| # run app with low permissions level user | ||
| # Set secure defaults | ||
| USER app | ||
| WORKDIR $HOME/node | ||
| ENV NODE_ENV=production \ | ||
| NODE_OPTIONS="--max-old-space-size=2048 --max-http-header-size=8192" | ||
|
|
||
| EXPOSE 3000 | ||
| # Health check | ||
| HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \ | ||
| CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1 | ||
|
|
||
| ENV NODE_ENV=production | ||
| EXPOSE 3000 | ||
|
|
||
| ENTRYPOINT ["dumb-init"] | ||
| # Use tini as init system | ||
| ENTRYPOINT ["/sbin/tini", "--"] | ||
| CMD ["node", "--enable-source-maps", "dist/index.js"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.