devsyncwrld
08db5374cb
OpenSSF Scorecard / Scorecard analysis (push) Waiting to run
CI / Build & test (Node 20) (push) Canceled after 0s
CI / Build & test (Node 24) (push) Canceled after 0s
CI / Build & test (push) Canceled after 0s
CodeQL / Analyze (javascript-typescript) (push) Canceled after 0s
Security / Secret scan (gitleaks) (push) Canceled after 0s
Security / Dependency scan (OSV-Scanner) (push) Canceled after 0s
Security / IaC/config scan (Trivy) (push) Canceled after 0s
Security / License compliance scan (Trivy) (push) Canceled after 0s
better-sqlite3@12.11.1 ships prebuilt binaries for ABI 127/137/141/147 only; Node 20 is ABI 115, so prebuild-install falls back to node-gyp, which fails on node:20-slim for lack of python3/make/g++. Add the toolchain to the builder stage, and in the runtime stage install, use and purge it inside a single layer so the final image ships no compiler.
124 lines
4.5 KiB
Docker
124 lines
4.5 KiB
Docker
# ============================================================
|
|
# Backspace — Multi-stage Docker build
|
|
# ============================================================
|
|
|
|
# Stage 1: Install dependencies and build frontend
|
|
FROM node:20-slim AS builder
|
|
|
|
RUN corepack enable && corepack prepare pnpm@10.34.3 --activate
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy workspace config
|
|
COPY package.json pnpm-workspace.yaml pnpm-lock.yaml* ./
|
|
COPY tsconfig.base.json ./
|
|
|
|
# Copy package.json files for all workspace packages
|
|
COPY packages/shared/package.json packages/shared/
|
|
COPY packages/server/package.json packages/server/
|
|
COPY packages/web/package.json packages/web/
|
|
|
|
# Copy patches (referenced by pnpm-lock.yaml)
|
|
COPY patches/ patches/
|
|
|
|
# better-sqlite3 publishes no prebuilt binary for Node 20 (ABI 115) — its
|
|
# releases cover ABI 127/137/141/147 only — so prebuild-install falls back to
|
|
# compiling with node-gyp, which needs python3/make/g++. node:20-slim ships
|
|
# none of them. Builder stage only: the runtime stage copies the compiled
|
|
# .node and stays slim.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
python3 make g++ \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install dependencies
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
# Copy source code (excluding desktop — not needed in Docker)
|
|
COPY packages/shared/ packages/shared/
|
|
COPY packages/server/ packages/server/
|
|
COPY packages/web/ packages/web/
|
|
|
|
# Build the web frontend
|
|
RUN pnpm --filter @backspace/web build
|
|
|
|
# ============================================================
|
|
# Stage 2: Production runtime
|
|
FROM node:20-slim AS runtime
|
|
|
|
RUN corepack enable && corepack prepare pnpm@10.34.3 --activate
|
|
|
|
# Runtime deps only: ffmpeg (media processing) + gosu (drop to non-root in the
|
|
# entrypoint). sharp is N-API (ABI-independent) and loads a prebuilt binary;
|
|
# better-sqlite3 no longer ships one for Node 20, so it is compiled below with
|
|
# a toolchain that is purged in the same layer.
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends ffmpeg gosu && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy workspace config
|
|
COPY package.json pnpm-workspace.yaml pnpm-lock.yaml* ./
|
|
COPY tsconfig.base.json ./
|
|
|
|
# Copy package.json files
|
|
COPY packages/shared/package.json packages/shared/
|
|
COPY packages/server/package.json packages/server/
|
|
COPY packages/web/package.json packages/web/
|
|
|
|
# Copy patches (referenced by pnpm-lock.yaml)
|
|
COPY patches/ patches/
|
|
|
|
# Install production dependencies only (tsx is in server dependencies).
|
|
# better-sqlite3 compiles from source here (no Node 20 prebuilt), so the C
|
|
# toolchain is installed, used and purged inside this single layer — the final
|
|
# image ships no compiler.
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends python3 make g++ && \
|
|
pnpm install --prod --frozen-lockfile && \
|
|
apt-get purge -y python3 make g++ && \
|
|
apt-get autoremove -y && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
# Copy shared source (needed at runtime since server imports types directly)
|
|
COPY packages/shared/ packages/shared/
|
|
|
|
# Copy server source
|
|
COPY packages/server/ packages/server/
|
|
|
|
# Copy built frontend from builder stage
|
|
COPY --from=builder /app/packages/web/dist packages/web/dist
|
|
|
|
# Create data directories
|
|
RUN mkdir -p /app/data/uploads
|
|
|
|
# Non-root hardening: copy the privilege-dropping entrypoint. It chowns the
|
|
# data volume as root, then execs the CMD as the unprivileged `node` user.
|
|
COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
|
|
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
|
|
|
|
# Set environment defaults
|
|
ENV NODE_ENV=production
|
|
ENV PORT=3000
|
|
ENV HOST=0.0.0.0
|
|
ENV DB_PATH=/app/data/backspace.db
|
|
ENV UPLOAD_DIR=/app/data/uploads
|
|
|
|
# AGPL-3.0 § 13 source offer: bake the running build's git commit into the image
|
|
# so GET /api/instance/info can advertise the exact version. Passed via
|
|
# --build-arg BACKSPACE_COMMIT=$(git rev-parse --short HEAD) (see deploy.sh /
|
|
# docker-compose.yml). Empty when git is unavailable → server treats as null.
|
|
ARG BACKSPACE_COMMIT=""
|
|
ENV BACKSPACE_COMMIT=$BACKSPACE_COMMIT
|
|
|
|
EXPOSE 3000
|
|
|
|
# Health check — reads PORT from environment so it works with any configured port
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=5 \
|
|
CMD node -e "fetch('http://localhost:' + (process.env.PORT || 3000) + '/api/health').then(r => r.ok ? process.exit(0) : process.exit(1)).catch(() => process.exit(1))"
|
|
|
|
# Run the server using tsx from the server package directory
|
|
WORKDIR /app/packages/server
|
|
ENTRYPOINT ["docker-entrypoint.sh"]
|
|
CMD ["node", "--import", "tsx/esm", "src/index.ts"]
|