Dockerfile.quickstart

# syntax=docker/dockerfile:1.7-labs
# check=skip=InvalidDefaultArgInFrom
# meith-board's deploy image — quick-start shape.
#
# Built from source rather than from the published framework base image, so
# there is nothing to publish and no image tag to paste anywhere: Coolify (or
# a plain `docker build`) turns this repository into a runnable image on its
# own. It installs the full @meith/web, @meith/cli and @meith/theme-default
# closure itself, which makes a build heavier than `Dockerfile` — the trade
# for needing no registry, no build workflow and no MEITH_IMAGE. Point Coolify
# at `docker-compose.quickstart.yaml` to use it; `Dockerfile` and
# `docker-compose.yaml` are the prebuilt path this board runs by default.
#
# Two stages, not three: unlike a pruned standalone image, this keeps the full
# node_modules tree, because the migrate role below runs `community migrate`
# and `community` materializes @meith/cli's sources with tsx at the moment it
# runs. The tick is driven by the compose file's own `worker` service — a
# lightweight loop against /api/system/tick — because @meith/worker is not
# published.
FROM node:26-alpine@sha256:aadf416b2cdce311a8811ba3f0608a61b77dbf997500e2eafe781b51f6a0b019 AS deps
WORKDIR /board

# This board's own manifest, cached independently of its source — editing
# meith.config.ts should not re-run npm install. Unlike the prebuilt path
# there is no warm base layer here, so this install resolves the whole
# closure from the registry; it is still cached until package.json changes.
COPY package.json ./
RUN npm install

FROM deps AS runtime
WORKDIR /board
COPY . .

ENV NEXT_TELEMETRY_DISABLED=1
ENV NODE_ENV=production

# DATA_SOURCE is scoped to this one RUN, not declared with ENV — an ENV
# persists into every container started from this image afterward, and this
# Dockerfile has no later stage to reset it in. The build needs neither a
# database nor a production secret, but baking DATA_SOURCE=fixture into the
# image itself would silently force fixture mode — and with it the in-memory
# queue driver — at runtime too, no matter what DATABASE_URL an operator
# supplies to `docker run`.
RUN DATA_SOURCE=fixture npx forum-web build

ENV PORT=3000
ENV HOSTNAME=0.0.0.0
EXPOSE 3000

# node:alpine already carries a non-root "node" user; the board's own files
# are copied in as root above, so they need handing over before this drops
# privilege.
RUN chown -R node:node /board
USER node

COPY --chown=node:node docker-entrypoint.sh docker-healthcheck.sh ./
RUN chmod +x docker-entrypoint.sh docker-healthcheck.sh

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD ["./docker-healthcheck.sh"]

ENTRYPOINT ["./docker-entrypoint.sh"]