|
1 | | - |
2 | | -# Base image |
3 | | -FROM node:18 |
4 | | - |
5 | | -# Create working directory |
6 | | -WORKDIR /usr/src/api |
7 | | - |
8 | | -# Copy package.json |
9 | | -COPY package.json ./ |
10 | | - |
11 | | -# Copy yarn.lcok |
12 | | -COPY yarn.lock ./ |
13 | | - |
14 | | -# run yarn install |
15 | | -RUN yarn install |
16 | | - |
17 | | -# Copy source code into docker image |
18 | | -COPY . . |
19 | | - |
20 | | -# Copy .env |
21 | | -COPY .env ./ |
22 | | - |
23 | | -# run build commands |
| 1 | +# Keep up to date with Active LTS: https://nodejs.org/en/about/previous-releases |
| 2 | +# |
| 3 | +# IMPORTANT: keep the 'run' layer below in sync. |
| 4 | +FROM node:22@sha256:23c24e85395992be118734a39903e08c8f7d1abc73978c46b6bda90060091a49 AS build |
| 5 | + |
| 6 | + |
| 7 | +# Create a non-root user to build (principle of least privilege). |
| 8 | +WORKDIR /build |
| 9 | +RUN groupadd --gid 2002 build && useradd --gid 2002 --uid 2002 --home /build build |
| 10 | +RUN chown 2002:2002 /build |
| 11 | +USER 2002:2002 |
| 12 | + |
| 13 | +# Install only runtime dependencies into a separate directory. This will be copied into the runner |
| 14 | +# image. |
| 15 | +WORKDIR /build/runtime_dependencies |
| 16 | +COPY --chown=2002:2002 package.json yarn.lock ./ |
| 17 | +RUN yarn install --frozen-lockfile --production |
| 18 | + |
| 19 | +# Copy package.json and yarn.lock in a separate layer from the source code and install the |
| 20 | +# dependencies. This allows docker to cache this step if package.json and yarn.lock haven't changed |
| 21 | +# from the last docker build, making build times a lot faster. |
| 22 | +WORKDIR /build |
| 23 | +COPY --chown=2002:2002 package.json yarn.lock ./ |
| 24 | +RUN yarn install --frozen-lockfile |
| 25 | + |
| 26 | +# Copy the source code and build. |
| 27 | +COPY --chown=2002:2002 . . |
24 | 28 | RUN yarn prisma generate |
25 | 29 | RUN yarn build |
26 | 30 |
|
27 | | -# Expose port 3100 for api |
28 | | -EXPOSE 3100 |
29 | | - |
30 | | -# Start api |
31 | | -CMD ["yarn", "dev"] |
| 31 | +# Start a new container filesystem and copy in just the runtime dependencies and the built |
| 32 | +# application. |
| 33 | +# |
| 34 | +# IMPORTANT: keep the 'build' layer above in sync. |
| 35 | +FROM node:22@sha256:23c24e85395992be118734a39903e08c8f7d1abc73978c46b6bda90060091a49 AS run |
| 36 | +WORKDIR /run |
| 37 | + |
| 38 | +# Copy over build artifacts. |
| 39 | +COPY --from=build /build/runtime_dependencies/ . |
| 40 | +COPY --from=build /build/dist ./dist |
| 41 | + |
| 42 | +# Need to copy the prisma schema file and generated package from `yarn prisma generate`. |
| 43 | +# TODO: be explicit about where the client package is generated: |
| 44 | +# https://www.prisma.io/docs/orm/prisma-client/setup-and-configuration/generating-prisma-client |
| 45 | +COPY --from=build /build/prisma/schema.prisma ./prisma/schema.prisma |
| 46 | +COPY --from=build /build/prisma/migrations ./prisma/migrations |
| 47 | +COPY --from=build /build/node_modules/.prisma ./node_modules/.prisma |
| 48 | + |
| 49 | +# Create a non-root user to run (priciple of least priviledge). |
| 50 | +WORKDIR /run |
| 51 | +RUN groupadd --gid 2002 run && useradd --gid 2002 --uid 2002 --home /run run |
| 52 | +RUN chown --recursive 2002:2002 /run |
| 53 | +USER 2002:2002 |
| 54 | + |
| 55 | +# Run any DB migrations then start the server. |
| 56 | +CMD [ "/bin/bash", "-c", "yarn db:migration:run && yarn start:prod" ] |
0 commit comments