Dockerfile

# Build arguments
ARG SOURCE_CODE=.
ARG BUILD_MODE=ODH

# Use ubi9/nodejs-22 as default base image
ARG BASE_IMAGE="registry.access.redhat.com/ubi9/nodejs-22:latest"

FROM ${BASE_IMAGE} as builder

## Build args to be used at this step
ARG SOURCE_CODE
ARG BUILD_MODE

WORKDIR /usr/src/app

## Copying in source code
COPY --chown=default:root ${SOURCE_CODE} /usr/src/app

# Change file ownership to the assemble user
USER default

RUN npm cache clean --force

RUN npm ci --ignore-scripts

ENV TURBO_TELEMETRY_DISABLED=1
RUN if [ "$BUILD_MODE" = "RHOAI" ]; then \
      echo "Setting up RHOAI vars.."; \
      echo '#!/bin/sh' > /tmp/env.sh; \
      echo 'export ODH_LOGO=../images/rhoai-logo.svg' >> /tmp/env.sh; \
      echo 'export ODH_LOGO_DARK=../images/rhoai-logo-dark-theme.svg' >> /tmp/env.sh; \
      echo 'export ODH_PRODUCT_NAME="Red Hat OpenShift AI"' >> /tmp/env.sh; \
      echo 'export ODH_FAVICON="rhoai-favicon.svg"' >> /tmp/env.sh; \
      echo 'export DOC_LINK="https://docs.redhat.com/en/documentation/red_hat_openshift_ai/"' >> /tmp/env.sh; \
      echo 'export SUPPORT_LINK="https://access.redhat.com/support/cases/#/case/new/open-case?caseCreate=true"' >> /tmp/env.sh; \
      echo 'export COMMUNITY_LINK=""' >> /tmp/env.sh; \
    else \
      echo "Sticking to ODH vars.."; \
      echo '#!/bin/sh' > /tmp/env.sh; \
    fi
RUN . /tmp/env.sh && npm run build

# npm prune --omit=dev does not correctly handle npm workspaces -- it only
# removes root-level devDependencies while leaving all workspace devDependencies
# hoisted in node_modules/. See scripts/prepare-production-manifest.js for details.
RUN node scripts/prepare-production-manifest.js \
    && npm install --omit=dev --omit=optional --ignore-scripts

# This rm -rf is a safety net. It is currently not needed, but it is a good idea to keep it in case future changes accidentally introduce esbuild binaries.
# Remove esbuild binaries to ensure FIPS compliance
# esbuild is a build-time dependency transitively included through @perses-dev/plugin-system
# -> @module-federation/enhanced -> @module-federation/cli -> @modern-js/node-bundle-require
# These Go binaries are NOT needed at runtime and are NOT FIPS compliant
RUN rm -rf node_modules/esbuild node_modules/@esbuild node_modules/.bin/esbuild

FROM ${BASE_IMAGE} as runtime

WORKDIR /usr/src/app

RUN mkdir /usr/src/app/logs && chmod 775 /usr/src/app/logs

USER 1001:0

COPY --chown=default:root --from=builder /usr/src/app/frontend/public /usr/src/app/frontend/public
COPY --chown=default:root --from=builder /usr/src/app/backend/package.json /usr/src/app/backend/package.json
COPY --chown=default:root --from=builder /usr/src/app/backend/node_modules /usr/src/app/backend/node_modules
COPY --chown=default:root --from=builder /usr/src/app/backend/dist /usr/src/app/backend/dist
COPY --chown=default:root --from=builder /usr/src/app/packages/app-config/package.json /usr/src/app/packages/app-config/package.json
COPY --chown=default:root --from=builder /usr/src/app/packages/app-config/dist /usr/src/app/packages/app-config/dist
COPY --chown=default:root --from=builder /usr/src/app/package.json /usr/src/app/package.json
COPY --chown=default:root --from=builder /usr/src/app/package-lock.json /usr/src/app/package-lock.json
COPY --chown=default:root --from=builder /usr/src/app/node_modules /usr/src/app/node_modules
COPY --chown=default:root --from=builder /usr/src/app/.npmrc /usr/src/app/.npmrc
COPY --chown=default:root --from=builder /usr/src/app/.env /usr/src/app/.env
COPY --chown=default:root --from=builder /usr/src/app/data /usr/src/app/data

WORKDIR /usr/src/app/backend

CMD ["npm", "run", "start"]

LABEL io.opendatahub.component="odh-dashboard" \
      io.k8s.display-name="odh-dashboard" \
      name="open-data-hub/odh-dashboard-ubi9" \
      summary="odh-dashboard" \
      description="Open Data Hub Dashboard"