portal/Containerfile at main · allthingslinux/portal · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
# ============================================================================
# Multi-stage Containerfile for Portal (Turborepo Monorepo)
# ============================================================================
# Stage 1: Pruner  - Prune workspace to only @portal/portal and its deps
# Stage 2: Deps    - Install production dependencies from pruned lockfile
# Stage 3: Builder - Build the Next.js application via turbo
# Stage 4: Runner  - Minimal production runtime
# ============================================================================

# Base image pinned for reproducibility
ARG NODE_IMAGE=node:22-alpine@sha256:e4bf2a82ad0a4037d28035ae71529873c069b13eb0455466ae0bc13363826e34

# ============================================================================
# Stage 1: Pruner — generate minimal workspace subset
# ============================================================================
FROM ${NODE_IMAGE} AS pruner
RUN apk add --no-cache libc6-compat
WORKDIR /app

ENV PNPM_HOME="/pnpm"
ENV PATH="$PNPM_HOME:$PATH"
RUN corepack enable && corepack prepare pnpm@10.28.2 --activate
RUN pnpm add -g turbo@^2

# Copy the full monorepo (filtered by .dockerignore)
COPY . .

# Prune to only the portal app and its workspace dependencies
RUN turbo prune @portal/portal --docker

# ============================================================================
# Stage 2: Deps — install dependencies from pruned package.json files
# ============================================================================
FROM ${NODE_IMAGE} AS deps
RUN apk add --no-cache libc6-compat
WORKDIR /app

RUN corepack enable && corepack prepare pnpm@10.28.2 --activate

# Copy only the pruned package.json files and lockfile (maximises layer cache)
COPY --from=pruner /app/out/json/ .

# Install dependencies using the pruned lockfile
RUN pnpm install --frozen-lockfile

# ============================================================================
# Stage 3: Builder — build the application
# ============================================================================
FROM ${NODE_IMAGE} AS builder
WORKDIR /app

RUN corepack enable && corepack prepare pnpm@10.28.2 --activate

# Copy installed node_modules from deps stage
COPY --from=deps /app/ .

# Copy full source from pruned workspace
COPY --from=pruner /app/out/full/ .

# Build-time environment variables
ARG NODE_ENV=production
ENV NODE_ENV=$NODE_ENV

ARG BETTER_AUTH_SECRET
ENV BETTER_AUTH_SECRET=$BETTER_AUTH_SECRET

ARG BETTER_AUTH_URL
ENV BETTER_AUTH_URL=$BETTER_AUTH_URL

ARG GIT_COMMIT_SHA
ENV GIT_COMMIT_SHA=$GIT_COMMIT_SHA

ENV NEXT_TELEMETRY_DISABLED=1

# Build the portal app (turbo handles dependency ordering)
RUN pnpm turbo run build --filter=@portal/portal

# ============================================================================
# Stage 4: Runner — minimal production image
# ============================================================================
FROM ${NODE_IMAGE} AS runner
WORKDIR /app

ENV NODE_ENV=production
ENV NEXT_TELEMETRY_DISABLED=1

# Create non-root user
RUN addgroup --system --gid 1001 nodejs && \
  adduser --system --uid 1001 nextjs

# Copy standalone output, static assets, and public files
COPY --from=builder /app/apps/portal/public ./public
COPY --from=builder --chown=nextjs:nodejs /app/apps/portal/.next/standalone ./
COPY --from=builder --chown=nextjs:nodejs /app/apps/portal/.next/static ./.next/static

RUN chown -R nextjs:nodejs /app

USER nextjs

EXPOSE 3000

ENV PORT=3000
ENV HOSTNAME="0.0.0.0"

# Health check against /api/health
HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
  CMD node -e "require('http').get('http://localhost:3000/api/health', (r) => {process.exit(r.statusCode === 200 ? 0 : 1)})"

CMD ["node", "server.js"]