9396be6fc0
Ensure the /app WORKDIR itself is owned by appuser (not just copied files), preventing runtime failures if the app writes to /app directly. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
51 lines
1.4 KiB
Docker
51 lines
1.4 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
FROM node:20-alpine AS deps
|
|
WORKDIR /app
|
|
|
|
COPY package.json package-lock.json ./
|
|
RUN npm ci
|
|
|
|
FROM node:20-alpine AS builder
|
|
WORKDIR /app
|
|
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY . ./
|
|
|
|
# Allows configuring the API URL at build time.
|
|
ARG NEXT_PUBLIC_API_URL=auto
|
|
ENV NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL}
|
|
ARG NEXT_PUBLIC_AUTH_MODE
|
|
ENV NEXT_PUBLIC_AUTH_MODE=${NEXT_PUBLIC_AUTH_MODE}
|
|
|
|
RUN npm run build
|
|
|
|
FROM node:20-alpine AS runner
|
|
WORKDIR /app
|
|
|
|
ENV NODE_ENV=production
|
|
ARG NEXT_PUBLIC_AUTH_MODE
|
|
|
|
# If provided at runtime, Next will expose NEXT_PUBLIC_* to the browser as well
|
|
# (but note some values may be baked at build time).
|
|
ENV NEXT_PUBLIC_API_URL=auto
|
|
ENV NEXT_PUBLIC_AUTH_MODE=${NEXT_PUBLIC_AUTH_MODE}
|
|
|
|
# Create non-root user before COPY so --chown can reference it.
|
|
# Using COPY --chown avoids a slow recursive chown on overlay2 (docker/for-linux#388).
|
|
RUN addgroup -S appgroup && adduser -S -G appgroup appuser \
|
|
&& chown appuser:appgroup /app
|
|
|
|
COPY --from=builder --chown=appuser:appgroup /app/.next ./.next
|
|
# `public/` is optional in Next.js apps; repo may not have it.
|
|
# Avoid failing the build when the directory is absent.
|
|
COPY --from=builder --chown=appuser:appgroup /app/package.json ./package.json
|
|
COPY --from=builder --chown=appuser:appgroup /app/node_modules ./node_modules
|
|
COPY --from=builder --chown=appuser:appgroup /app/next.config.ts ./next.config.ts
|
|
|
|
USER appuser
|
|
|
|
EXPOSE 3000
|
|
|
|
CMD ["npm", "run", "start"]
|