767afb56d5
- Add resource limits (memory/CPU) and reservations for all services - Add security hardening: read_only, no-new-privileges, tmpfs for temp dirs - Add missing prod services: loki, promtail, pg-backup from dev compose - Fix API healthcheck to include catch() for proper exit codes - Add json-file logging driver with rotation limits across all services - Remove exposed PostgreSQL port in prod (internal only) - Add shm_size for PostgreSQL shared memory - Add non-root user (appuser) to AI services Dockerfile - Add --chown=node:node to COPY directives in API/Web Dockerfiles - Harden .dockerignore: exclude IDE files, OS files, docker-compose files - Fix Redis URL to include password authentication - Add JWT_REFRESH_SECRET to API environment - Add Grafana dependency on Loki for log datasource Co-Authored-By: Paperclip <noreply@paperclip.ing>
43 lines
1.3 KiB
Docker
43 lines
1.3 KiB
Docker
# ---- Base ----
|
|
FROM node:22-slim AS base
|
|
RUN corepack enable && corepack prepare pnpm@10.27.0 --activate
|
|
WORKDIR /app
|
|
|
|
# ---- Dependencies ----
|
|
FROM base AS deps
|
|
COPY pnpm-lock.yaml pnpm-workspace.yaml package.json turbo.json ./
|
|
COPY apps/web/package.json apps/web/
|
|
RUN pnpm install --frozen-lockfile --filter @goodgo/web...
|
|
|
|
# ---- Build ----
|
|
FROM base AS build
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY --from=deps /app/apps/web/node_modules ./apps/web/node_modules
|
|
COPY tsconfig.base.json ./
|
|
COPY apps/web/ apps/web/
|
|
RUN cd apps/web && npx next build
|
|
|
|
# ---- Production ----
|
|
FROM node:22-slim AS production
|
|
RUN apt-get update && apt-get install -y --no-install-recommends dumb-init && rm -rf /var/lib/apt/lists/*
|
|
WORKDIR /app
|
|
|
|
ENV NODE_ENV=production
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
ENV HOSTNAME=0.0.0.0
|
|
ENV PORT=3000
|
|
|
|
COPY --from=build --chown=node:node /app/apps/web/public ./public
|
|
COPY --from=build --chown=node:node /app/apps/web/.next/standalone ./
|
|
COPY --from=build --chown=node:node /app/apps/web/.next/static ./.next/static
|
|
|
|
EXPOSE 3000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD node -e "fetch('http://localhost:3000/api/health').then(r => { if (!r.ok) throw 1 }).catch(() => { process.exit(1) })"
|
|
|
|
USER node
|
|
|
|
ENTRYPOINT ["dumb-init", "--"]
|
|
CMD ["node", "server.js"]
|