65 lines
2.9 KiB
Docker
65 lines
2.9 KiB
Docker
# syntax=docker/dockerfile:1
|
||
|
||
# =============================================================
|
||
# MPM – Management-Container
|
||
# Single container with a restricted-capability root supervisor.
|
||
# Backend, Nginx workers, and modules otherwise run unprivileged:
|
||
# - Nginx (Reverse Proxy, Port 8080)
|
||
# - NestJS Management-Backend (127.0.0.1:3000)
|
||
# Ab Phase 3 laufen hier zusätzlich die Modul-Prozesse.
|
||
# Kein Docker-in-Docker, kein Docker-Socket.
|
||
# =============================================================
|
||
|
||
# ---------- Frontend-Build ----------
|
||
FROM node:24-slim AS frontend-build
|
||
WORKDIR /build
|
||
COPY apps/platform-frontend/package.json apps/platform-frontend/package-lock.json ./
|
||
RUN npm ci
|
||
COPY apps/platform-frontend/ ./
|
||
RUN npm run build
|
||
|
||
# ---------- Backend-Build ----------
|
||
FROM node:24-slim AS backend-runtime-deps
|
||
WORKDIR /build
|
||
COPY apps/platform-backend/package.json apps/platform-backend/package-lock.json ./
|
||
RUN --mount=type=cache,target=/root/.npm npm ci --omit=dev --no-audit --no-fund
|
||
|
||
FROM node:24-slim AS backend-build
|
||
WORKDIR /build
|
||
COPY apps/platform-backend/package.json apps/platform-backend/package-lock.json ./
|
||
RUN npm ci
|
||
COPY apps/platform-backend/ ./
|
||
RUN npm run build
|
||
|
||
# ---------- Laufzeit-Image ----------
|
||
FROM node:24-slim AS runtime
|
||
|
||
RUN apt-get update \
|
||
&& apt-get install -y --no-install-recommends nginx supervisor util-linux docker.io docker-compose \
|
||
&& rm -rf /var/lib/apt/lists/*
|
||
|
||
# Unprivileged service account for backend and module processes
|
||
RUN groupadd --gid 1001 app \
|
||
&& useradd --uid 1001 --gid 1001 --create-home --shell /usr/sbin/nologin app \
|
||
&& mkdir -p /tmp/nginx/client_body /tmp/nginx/proxy /tmp/nginx/fastcgi /tmp/nginx/uwsgi /tmp/nginx/scgi /var/log/supervisor /app/data/modules /app/data/logs \
|
||
&& chown -R app:app /tmp/nginx /var/log/supervisor /app/data
|
||
|
||
COPY docker/nginx/nginx.conf /etc/nginx/nginx.conf.template
|
||
COPY docker/nginx/render-config.cjs /usr/local/lib/mpm/render-nginx-config.cjs
|
||
COPY docker/nginx/start-nginx.sh /usr/local/bin/start-mpm-nginx
|
||
RUN chmod +x /usr/local/bin/start-mpm-nginx
|
||
COPY docker/supervisor/supervisord.conf /etc/supervisor/supervisord.conf
|
||
|
||
COPY --from=backend-build --chown=app:app /build/dist /app/platform-backend/dist
|
||
COPY --from=backend-runtime-deps --chown=app:app /build/node_modules /app/platform-backend/node_modules
|
||
COPY --from=backend-build --chown=app:app /build/package.json /app/platform-backend/package.json
|
||
COPY --from=frontend-build --chown=app:app /build/dist /app/public
|
||
|
||
USER root
|
||
EXPOSE 8080
|
||
|
||
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
|
||
CMD node -e "const http=require('node:http');const host=new URL(process.env.MARKETPLACE_PUBLIC_URL??'http://127.0.0.1:8080').host;http.get({hostname:'127.0.0.1',port:8080,path:'/api/v1/health',headers:{Host:host}},r=>process.exit(r.statusCode===200?0:1)).on('error',()=>process.exit(1))"
|
||
|
||
CMD ["/usr/bin/supervisord", "-n", "-c", "/etc/supervisor/supervisord.conf"]
|