lxe/mpm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: marketplace modules and isolated container management

Browse Source
This commit is contained in:
ayde64
2026-10-07 23:18:02 +02:00
parent 564f7def1c
commit 7b121fa908
68 changed files with 2560 additions and 699 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
Dockerfile
View File

@@ -2,8 +2,8 @@
# =============================================================
# MPM – Management-Container
# Ein einzelner Container, der als unprivilegierter Benutzer
# folgende Prozesse verwaltet (via Supervisor):
# Single container with a restricted-capability root supervisor.
# Backend, Nginx workers, and modules otherwise run unprivileged:
# - Nginx (Reverse Proxy, Port 8080)
# - NestJS Management-Backend (127.0.0.1:3000)
# Ab Phase 3 laufen hier zusätzlich die Modul-Prozesse.
@@ -19,22 +19,26 @@ COPY apps/platform-frontend/ ./
RUN npm run build
# ---------- Backend-Build ----------
FROM node:24-slim AS backend-runtime-deps
WORKDIR /build
COPY apps/platform-backend/package.json apps/platform-backend/package-lock.json ./
RUN --mount=type=cache,target=/root/.npm npm ci --omit=dev --no-audit --no-fund
FROM node:24-slim AS backend-build
WORKDIR /build
COPY apps/platform-backend/package.json apps/platform-backend/package-lock.json ./
RUN npm ci
COPY apps/platform-backend/ ./
RUN npm run build
RUN npm prune --omit=dev
# ---------- Laufzeit-Image ----------
FROM node:24-slim AS runtime
RUN apt-get update \
&& apt-get install -y --no-install-recommends nginx supervisor \
&& apt-get install -y --no-install-recommends nginx supervisor util-linux docker.io docker-compose \
&& rm -rf /var/lib/apt/lists/*
# Unprivilegierter Benutzer für alle Prozesse im Container
# Unprivileged service account for backend and module processes
RUN groupadd --gid 1001 app \
&& useradd --uid 1001 --gid 1001 --create-home --shell /usr/sbin/nologin app \
&& mkdir -p /tmp/nginx/client_body /tmp/nginx/proxy /tmp/nginx/fastcgi /tmp/nginx/uwsgi /tmp/nginx/scgi /var/log/supervisor /app/data/modules /app/data/logs \
@@ -44,14 +48,14 @@ COPY docker/nginx/nginx.conf /etc/nginx/nginx.conf
COPY docker/supervisor/supervisord.conf /etc/supervisor/supervisord.conf
COPY --from=backend-build --chown=app:app /build/dist /app/platform-backend/dist
COPY --from=backend-build --chown=app:app /build/node_modules /app/platform-backend/node_modules
COPY --from=backend-runtime-deps --chown=app:app /build/node_modules /app/platform-backend/node_modules
COPY --from=backend-build --chown=app:app /build/package.json /app/platform-backend/package.json
COPY --from=frontend-build --chown=app:app /build/dist /app/public
USER app
USER root
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
CMD node -e "fetch('http://127.0.0.1:8080/api/v1/health').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"
CMD ["/usr/bin/supervisord", "-n", "-c", "/etc/supervisor/supervisord.conf"]
CMD ["/usr/bin/supervisord", "-n", "-c", "/etc/supervisor/supervisord.conf"]