-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathDockerfile
105 lines (82 loc) · 4.37 KB
/
Dockerfile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
# syntax=docker/dockerfile:1
# using alpine base image to avoid `sharp` memory leaks.
# @see https://sharp.pixelplumbing.com/install#linux-memory-allocator
# build
FROM node:22-alpine AS build
# prisma 5.x does not find ssl on newer alpine versione
# @see https://github.com/prisma/prisma/issues/25817
# @see https://github.com/nodejs/docker-node/issues/2175
RUN ln -s /usr/lib/libssl.so.3 /lib/libssl.so.3
# @see https://github.com/nodejs/corepack/issues/612#issuecomment-2631462297
ENV COREPACK_INTEGRITY_KEYS='{"npm":[{"expires":"2025-01-29T00:00:00.000Z","keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="},{"expires":null,"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g=="}]}'
RUN corepack enable
RUN mkdir /app && chown -R node:node /app
WORKDIR /app
USER node
COPY --chown=node:node .npmrc package.json pnpm-lock.yaml ./
RUN pnpm fetch
COPY --chown=node:node ./ ./
ARG NEXT_PUBLIC_APP_BASE_URL
ARG NEXT_PUBLIC_BOTS
ARG NEXT_PUBLIC_GOOGLE_SITE_VERIFICATION
ARG NEXT_PUBLIC_KEYSTATIC_GITHUB_APP_SLUG
ARG NEXT_PUBLIC_KEYSTATIC_GITHUB_REPO_NAME
ARG NEXT_PUBLIC_KEYSTATIC_GITHUB_REPO_OWNER
ARG NEXT_PUBLIC_KEYSTATIC_MODE
ARG NEXT_PUBLIC_MATOMO_BASE_URL
ARG NEXT_PUBLIC_MATOMO_ID
ARG NEXT_PUBLIC_REDMINE_ID
# disable validation for runtime environment variables
ENV ENV_VALIDATION=public
RUN pnpm install --frozen-lockfile --offline
ENV BUILD_MODE=standalone
ENV NODE_ENV=production
ENV NEXT_TELEMETRY_DISABLED=1
# mount secrets which need to be available at build time
# RUN --mount=type=secret,id=MY_SECRET,uid=1000 MY_SECRET=$(cat /run/secrets/MY_SECRET) pnpm run build
RUN --mount=type=secret,id=AUTH_SECRET,uid=1000 \
--mount=type=secret,id=EMAIL_CONTACT_ADDRESS,uid=1000 \
--mount=type=secret,id=EMAIL_SMTP_PORT,uid=1000 \
--mount=type=secret,id=EMAIL_SMTP_SERVER,uid=1000 \
--mount=type=secret,id=DATABASE_DIRECT_URL,uid=1000 \
--mount=type=secret,id=DATABASE_URL,uid=1000 \
--mount=type=secret,id=KEYSTATIC_GITHUB_CLIENT_ID,uid=1000 \
--mount=type=secret,id=KEYSTATIC_GITHUB_CLIENT_SECRET,uid=1000 \
--mount=type=secret,id=KEYSTATIC_SECRET,uid=1000 \
--mount=type=secret,id=SSHOC_MARKETPLACE_API_BASE_URL,uid=1000 \
--mount=type=secret,id=SSHOC_MARKETPLACE_BASE_URL,uid=1000 \
--mount=type=secret,id=SSHOC_MARKETPLACE_PASSWORD,uid=1000 \
--mount=type=secret,id=SSHOC_MARKETPLACE_USER_NAME,uid=1000 \
AUTH_SECRET=$(cat /run/secrets/AUTH_SECRET) \
EMAIL_CONTACT_ADDRESS=$(cat /run/secrets/EMAIL_CONTACT_ADDRESS) \
EMAIL_SMTP_PORT=$(cat /run/secrets/EMAIL_SMTP_PORT) \
EMAIL_SMTP_SERVER=$(cat /run/secrets/EMAIL_SMTP_SERVER) \
DATABASE_DIRECT_URL=$(cat /run/secrets/DATABASE_DIRECT_URL) \
DATABASE_URL=$(cat /run/secrets/DATABASE_URL) \
KEYSTATIC_GITHUB_CLIENT_ID=$(cat /run/secrets/KEYSTATIC_GITHUB_CLIENT_ID) \
KEYSTATIC_GITHUB_CLIENT_SECRET=$(cat /run/secrets/KEYSTATIC_GITHUB_CLIENT_SECRET) \
KEYSTATIC_SECRET=$(cat /run/secrets/KEYSTATIC_SECRET) \
SSHOC_MARKETPLACE_API_BASE_URL=$(cat /run/secrets/SSHOC_MARKETPLACE_API_BASE_URL) \
SSHOC_MARKETPLACE_BASE_URL=$(cat /run/secrets/SSHOC_MARKETPLACE_BASE_URL) \
SSHOC_MARKETPLACE_PASSWORD=$(cat /run/secrets/SSHOC_MARKETPLACE_PASSWORD) \
SSHOC_MARKETPLACE_USER_NAME=$(cat /run/secrets/SSHOC_MARKETPLACE_USER_NAME) \
pnpm run build
# serve
FROM node:22-alpine AS serve
# prisma 5.x does not find ssl on newer alpine versione
# @see https://github.com/prisma/prisma/issues/25817
# @see https://github.com/nodejs/docker-node/issues/2175
RUN ln -s /usr/lib/libssl.so.3 /lib/libssl.so.3
RUN mkdir /app && chown -R node:node /app
WORKDIR /app
USER node
COPY --from=build --chown=node:node /app/next.config.js ./
COPY --from=build --chown=node:node /app/public ./public
COPY --from=build --chown=node:node /app/content ./content
COPY --from=build --chown=node:node /app/.next/standalone ./
COPY --from=build --chown=node:node /app/.next/static ./.next/static
# Ensure folder is owned by node:node when mounted as volume.
RUN mkdir -p /app/.next/cache/images
ENV NODE_ENV=production
EXPOSE 3000
CMD ["node", "server.js"]