linus
5fd2d47a64
Introduce a CodeResolverService to classify user login codes, complete with detailed resolution logic and usability checks. Extend the sync system to handle conflicts via last-write-wins arbitration, with detailed conflict tracking for review. Update file permissions and runtime isolation in Docker to enhance security.
38 lines
1.7 KiB
Docker
38 lines
1.7 KiB
Docker
# syntax=docker/dockerfile:1
|
|
#
|
|
# Server-only image (this repo has no Flutter client). The web client is
|
|
# built in the KC-APP client repo and its `build/web` output is mounted
|
|
# into the container at runtime via WEB_CLIENT_DIR (see docker-compose.yml).
|
|
|
|
# --- 1. Backend build ---------------------------------------------------------
|
|
FROM node:20-bookworm-slim AS api-build
|
|
WORKDIR /src
|
|
# Prisma detects the OpenSSL version at `generate` time to pick the matching
|
|
# query engine binary; without OpenSSL present here it silently defaults to
|
|
# openssl-1.1.x, which then fails to load in the runtime stage (openssl 3.0.x).
|
|
RUN apt-get update && apt-get install -y --no-install-recommends openssl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
COPY package.json package-lock.json ./
|
|
RUN npm ci
|
|
COPY . .
|
|
RUN npx prisma generate && npm run build
|
|
|
|
# --- 2. Runtime -------------------------------------------------------------
|
|
FROM node:20-bookworm-slim AS runtime
|
|
ENV NODE_ENV=production
|
|
WORKDIR /app
|
|
# Prisma needs OpenSSL at runtime.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends openssl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
RUN groupadd -g 1001 kc-user && useradd -u 1001 -g kc-user -m -d /home/kc-user kc-user
|
|
COPY --from=api-build --chown=kc-user:kc-user /src/node_modules ./node_modules
|
|
COPY --from=api-build --chown=kc-user:kc-user /src/dist ./dist
|
|
COPY --from=api-build --chown=kc-user:kc-user /src/prisma ./prisma
|
|
RUN chown -R kc-user:kc-user /app
|
|
USER kc-user
|
|
# Web client bundle is bind-mounted at runtime, not baked into the image;
|
|
# app.module reads WEB_CLIENT_DIR. See docker-compose.yml.
|
|
EXPOSE 3000
|
|
# Apply pending migrations, then boot.
|
|
CMD ["sh", "-c", "npx prisma migrate deploy && node dist/main.js"]
|