49 lines
2.1 KiB
Docker
49 lines
2.1 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
# =============================================================================
|
|
# SPA image: build with Node, serve the static bundle with nginx.
|
|
#
|
|
# The runtime image contains no Node, no sources and no package manager - just
|
|
# nginx and a handful of hashed assets, running as an unprivileged user.
|
|
# =============================================================================
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Stage 1 - build
|
|
# -----------------------------------------------------------------------------
|
|
FROM node:22-alpine AS builder
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy the manifests first so `npm ci` is cached until a dependency changes.
|
|
COPY frontend/package.json frontend/package-lock.json* ./
|
|
RUN npm ci --no-audit --no-fund
|
|
|
|
COPY frontend/ ./
|
|
# Same-origin API path: nginx proxies /api to the Django service.
|
|
ENV VITE_API_BASE_URL=/api/v1
|
|
RUN npm run build
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Stage 2 - serve
|
|
# -----------------------------------------------------------------------------
|
|
FROM nginx:1.27-alpine AS runtime
|
|
|
|
RUN rm -rf /usr/share/nginx/html/* /etc/nginx/conf.d/default.conf
|
|
COPY frontend/nginx.conf /etc/nginx/conf.d/app.conf
|
|
# Included by the location blocks in app.conf - see each file's own comment.
|
|
COPY frontend/security-headers.conf /etc/nginx/conf.d/security-headers.conf
|
|
COPY frontend/proxy-backend.conf /etc/nginx/conf.d/proxy-backend.conf
|
|
COPY --from=builder /app/dist /usr/share/nginx/html
|
|
|
|
# nginx:alpine already ships an unprivileged "nginx" user; the official
|
|
# unprivileged entrypoint needs these directories to be writable by it.
|
|
RUN touch /var/run/nginx.pid \
|
|
&& chown -R nginx:nginx /var/run/nginx.pid /var/cache/nginx /usr/share/nginx/html
|
|
|
|
USER nginx
|
|
EXPOSE 8080
|
|
|
|
# 127.0.0.1, not localhost: nginx listens on IPv4 only, and busybox wget
|
|
# resolves localhost to ::1 first without falling back to IPv4.
|
|
HEALTHCHECK --interval=30s --timeout=4s --start-period=10s --retries=3 \
|
|
CMD wget -q --spider http://127.0.0.1:8080/healthz || exit 1
|