|
1 | | -# 1. Base: install dependencies |
2 | | -FROM oven/bun:1 as base |
| 1 | +# ===== DEPENDENCIES STAGE ===== |
| 2 | +FROM oven/bun:1-alpine AS deps |
3 | 3 | WORKDIR /app |
4 | | -COPY package.json bun.lock ./ |
| 4 | + |
| 5 | +# Copy dependency files |
| 6 | +COPY package.json bun.lock* ./ |
| 7 | + |
| 8 | +# Install all dependencies (including dev dependencies for build) |
5 | 9 | RUN bun install --frozen-lockfile |
6 | 10 |
|
7 | | -# 2. Builder: copy source + build |
8 | | -FROM base as builder |
| 11 | +# ===== BUILDER STAGE ===== |
| 12 | +FROM oven/bun:1-alpine AS builder |
9 | 13 | WORKDIR /app |
10 | | -COPY . . |
11 | | -RUN bun run build |
12 | 14 |
|
13 | | -# 3. Runner: production image |
14 | | -FROM oven/bun:1-slim as runner |
| 15 | +# Copy dependencies from deps stage |
| 16 | +COPY --from=deps /app/node_modules ./node_modules |
| 17 | +COPY package.json bun.lock* ./ |
| 18 | + |
| 19 | +# Copy source code (excluding unnecessary files via .dockerignore) |
| 20 | +COPY app ./app |
| 21 | +COPY components ./components |
| 22 | +COPY contexts ./contexts |
| 23 | +COPY hooks ./hooks |
| 24 | +COPY lib ./lib |
| 25 | +COPY public ./public |
| 26 | +COPY next.config.ts ./ |
| 27 | +COPY tsconfig.json ./ |
| 28 | +COPY postcss.config.mjs ./ |
| 29 | +COPY components.json ./ |
| 30 | + |
| 31 | +# Build application with optimizations |
| 32 | +RUN NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 bun run build |
| 33 | + |
| 34 | +# ===== PRODUCTION STAGE ===== |
| 35 | +FROM oven/bun:1-alpine AS runner |
15 | 36 | WORKDIR /app |
16 | 37 |
|
17 | | -ENV NODE_ENV=production |
18 | | -ENV PORT=3000 |
| 38 | +# Install runtime dependencies and security updates |
| 39 | +RUN apk add --no-cache \ |
| 40 | + curl \ |
| 41 | + ca-certificates \ |
| 42 | + && apk upgrade --no-cache \ |
| 43 | + && rm -rf /var/cache/apk/* |
19 | 44 |
|
20 | | -# Copy built app |
21 | | -COPY --from=builder /app/.next ./.next |
22 | | -COPY --from=builder /app/public ./public |
23 | | -COPY --from=builder /app/package.json ./package.json |
24 | | -COPY --from=builder /app/bun.lock ./bun.lock |
| 45 | +# Create non-root user for security |
| 46 | +RUN addgroup --system --gid 1001 nodejs && \ |
| 47 | + adduser --system --uid 1001 nextjs |
25 | 48 |
|
26 | | -# Install only production deps |
27 | | -RUN bun install --frozen-lockfile --production |
| 49 | +# No environment variables - all hardcoded for consistency |
28 | 50 |
|
| 51 | +# Copy built application with proper ownership |
| 52 | +COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./ |
| 53 | +COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static |
| 54 | +COPY --from=builder --chown=nextjs:nodejs /app/public ./public |
| 55 | + |
| 56 | +# Switch to non-root user |
| 57 | +USER nextjs |
| 58 | + |
| 59 | +# Expose port |
29 | 60 | EXPOSE 3000 |
30 | | -CMD ["bun", "run", "start"] |
| 61 | + |
| 62 | +# Add health check using one of your API endpoints |
| 63 | +HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \ |
| 64 | + CMD curl -f http://localhost:3000/api/login || exit 1 |
| 65 | + |
| 66 | +# Start application with hardcoded settings |
| 67 | +CMD ["sh", "-c", "NODE_ENV=production PORT=3000 HOSTNAME=0.0.0.0 node server.js"] |
0 commit comments