34 lines
1.5 KiB
Docker
34 lines
1.5 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# The Memby operations console.
|
|
#
|
|
# Two stages: Node builds the static bundle, nginx serves it. Nothing from Node survives
|
|
# into the running image — the console is a directory of files, and the container's only
|
|
# job is to hand them over on the compose network. It is never published: the gateway
|
|
# reverse-proxies /admin to it, so the console shares the gateway's origin, cookie and
|
|
# single ingress.
|
|
|
|
FROM node:22-alpine AS build
|
|
WORKDIR /ui
|
|
|
|
# Dependencies first so an edit to the source does not re-resolve the whole tree.
|
|
COPY package.json package-lock.json* ./
|
|
# `npm ci` when there is a lockfile — reproducible, and the only reason a lockfile is
|
|
# checked in — falling back to `npm install` so a first build works without one.
|
|
RUN if [ -f package-lock.json ]; then npm ci; else npm install; fi
|
|
|
|
COPY tsconfig.json vite.config.ts index.html ./
|
|
COPY src ./src
|
|
# The type check is part of the build rather than a separate step: a console that compiles
|
|
# to JavaScript but reads a field the gateway does not send is exactly the failure the
|
|
# hand-written wire types exist to catch, and it must not reach a deployment.
|
|
RUN npm run build
|
|
|
|
FROM nginx:1.27-alpine
|
|
# Read-only, non-root and no default site: the image serves one directory and does nothing
|
|
# else. nginx's own temp paths are the only writable thing it needs, and they are declared
|
|
# as tmpfs in docker-compose.yml.
|
|
COPY nginx.conf /etc/nginx/conf.d/default.conf
|
|
COPY --from=build /ui/dist /usr/share/nginx/html
|
|
EXPOSE 80
|