Claude Opus 5
485c8fa538
All checks were successful
CI / Auth e2e pack (pull_request) Successful in 8m49s
CD / Build and push images (push) Successful in 14s
CD / Deploy to Test (push) Successful in 17s
CD / Smoke tests against Test (push) Successful in 1m21s
CD / Promote to Int (push) Successful in 12s
CI / Lint, typecheck, test (push) Successful in 6m35s
CI / Build container images (push) Has been skipped
CI / Auth e2e pack (push) Successful in 8m30s
CI / Import/export fidelity gate (push) Successful in 57s
CI / Build container images (pull_request) Successful in 2m52s
CI / Lint, typecheck, test (pull_request) Successful in 6m28s
CI / Import/export fidelity gate (pull_request) Successful in 57s
Found on the real deploy, not in any test: `/data/fonts` in the running api container was `root:root` and the non-root `node` user could not write to it. Every upload would have failed with EACCES at runtime while the api reported ready. The api Dockerfile already explains the mechanism for uploads and plugins — Docker copies an image directory's ownership into a fresh named volume on first mount — and pre-creates them chowned. #303 added `CUSTOM_FONTS_DIR` to the ENV but not to that mkdir/chown line. Adds a CI fence so it cannot recur: every `/data/…` path the api image defaults to must also appear in the mkdir AND the chown. Verified against the actual defect — removing `/data/fonts` from the chown makes it fail.
50 lines
2.6 KiB
Docker
50 lines
2.6 KiB
Docker
# Build context is the repository root (workspace build):
|
|
# docker build -f apps/api/Dockerfile .
|
|
|
|
FROM node:22.15.1-alpine AS build
|
|
WORKDIR /repo
|
|
RUN npm install -g pnpm@11
|
|
COPY pnpm-workspace.yaml pnpm-lock.yaml package.json tsconfig.base.json ./
|
|
COPY packages/shared ./packages/shared
|
|
COPY packages/plugin-sdk ./packages/plugin-sdk
|
|
COPY apps/api ./apps/api
|
|
COPY deploy/fonts ./deploy/fonts
|
|
RUN pnpm install --frozen-lockfile --filter @dorfteich/api... \
|
|
&& pnpm --filter @dorfteich/shared build \
|
|
&& pnpm --filter @dorfteich/plugin-sdk build \
|
|
&& pnpm --filter @dorfteich/api build \
|
|
# Bake the self-hosted font catalog in so the PDF exporter can inline a
|
|
# pond's fonts as base64 (ADR 0016). Same download as the web image; fails
|
|
# the build if a family lacks license info.
|
|
&& FONTS_OUT=/repo/fonts node deploy/fonts/build-fonts.mjs \
|
|
# Self-contained production bundle (prod deps only, incl. the prisma CLI
|
|
# needed for migrate-on-start) at /out.
|
|
&& pnpm --filter @dorfteich/api deploy --prod --legacy /out \
|
|
&& cp -r apps/api/dist /out/dist \
|
|
&& cp -r apps/api/assets /out/assets \
|
|
&& cp -r /repo/fonts /out/fonts
|
|
|
|
FROM node:22.15.1-alpine
|
|
ARG APP_VERSION=0.0.0-dev
|
|
# Default the data dirs to the writable, node-owned locations created below, so
|
|
# the image works out of the box even where compose does not set them; compose
|
|
# still mounts named volumes here for persistence (UPLOADS_DIR/PLUGINS_DIR).
|
|
ENV NODE_ENV=production APP_VERSION=${APP_VERSION} UPLOADS_DIR=/data/uploads PLUGINS_DIR=/data/plugins CUSTOM_FONTS_DIR=/data/fonts SECRETS_FILE=/data/secrets/secrets.env BACKUPS_DIR=/data/backups
|
|
WORKDIR /app
|
|
COPY --from=build --chown=node:node /out /app
|
|
# Generate the Prisma client for this image's platform.
|
|
RUN node node_modules/prisma/build/index.js generate
|
|
# A fresh named volume mounted at /data/uploads, /data/plugins or /data/fonts
|
|
# is created
|
|
# root-owned; pre-creating them here (Docker copies an image directory's
|
|
# ownership into a new volume on first mount) lets the non-root `node` user
|
|
# write to them. /data/backups is mounted read-only here, but pre-creating it
|
|
# node-owned keeps the shared `backups` volume writable for the backup
|
|
# sidecar even when the api container is the one that initializes it.
|
|
RUN mkdir -p /data/uploads /data/plugins /data/fonts /data/secrets /data/backups && chown -R node:node /data/uploads /data/plugins /data/fonts /data/secrets /data/backups
|
|
USER node
|
|
EXPOSE 3000
|
|
HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
|
|
CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/api/v1/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
|
|
CMD ["node", "dist/main.js"]
|