0e213d8549
* chore: update Dockerfile to run it as non-root user across multiple apps and install shadow-utils * chore: update Dockerfiles to install shadow-utils using dnf and ensure non-root user execution in admin, web, and live apps * chore: add Dockerfile configurations for Node Runner and Flux, including shadow-utils installation and non-root user execution * chore: update Dockerfile.fips to set permissions for /app and /var/tls, and expose port 8000 * chore: update Dockerfiles to install crypto-policies and set FIPS mode across multiple applications * chore: replace microdnf with dnf for installing crypto-policies in Dockerfiles for admin and web applications * chore: update Dockerfiles to set up Nginx directories and rebuild sharp for UBI compatibility in admin, live, and web applications * chore: update Dockerfiles to include /run directory for Nginx and adjust ownership settings in admin, live, and web applications * chore: refactor Dockerfile.fips to use node:22-alpine, streamline dependency installation, and adjust working directory structure for the live application * chore: update Dockerfile.fips to use UBI base image, streamline dependency installation, and enhance runtime configuration for the live application * fix: exclude src/scripts from tsc to resolve missing @hocuspocus/provider types * feat: add FIPS Docker image variables for Node Runner and Flux * fix: update TURBO_VERSION to 2.8.13 and clean up Dockerfile --------- Co-authored-by: Palanikannan M <[email protected]>
104 lines
3.1 KiB
Docker
104 lines
3.1 KiB
Docker
FROM node:22-alpine AS base
|
|
|
|
WORKDIR /app
|
|
|
|
ENV TURBO_TELEMETRY_DISABLED=1
|
|
ENV PNPM_HOME="/pnpm"
|
|
ENV PATH="$PNPM_HOME:$PATH"
|
|
ENV CI=1
|
|
|
|
RUN corepack enable pnpm
|
|
|
|
# =========================================================================== #
|
|
|
|
FROM base AS builder
|
|
|
|
ARG TURBO_VERSION=2.8.13
|
|
RUN pnpm add -g turbo@${TURBO_VERSION}
|
|
|
|
COPY . .
|
|
|
|
# Create a pruned workspace for just the admin app
|
|
RUN turbo prune --scope=admin --docker
|
|
|
|
# =========================================================================== #
|
|
|
|
FROM base AS installer
|
|
|
|
# Build in production mode; we still install dev deps explicitly below
|
|
ENV NODE_ENV=production
|
|
|
|
# Public envs required at build time (pick up via process.env)
|
|
ARG VITE_API_BASE_URL=""
|
|
ENV VITE_API_BASE_URL=$VITE_API_BASE_URL
|
|
ARG VITE_API_BASE_PATH="/api"
|
|
ENV VITE_API_BASE_PATH=$VITE_API_BASE_PATH
|
|
|
|
ARG VITE_ADMIN_BASE_URL=""
|
|
ENV VITE_ADMIN_BASE_URL=$VITE_ADMIN_BASE_URL
|
|
ARG VITE_ADMIN_BASE_PATH="/god-mode/"
|
|
ENV VITE_ADMIN_BASE_PATH=$VITE_ADMIN_BASE_PATH
|
|
|
|
ARG VITE_SPACE_BASE_URL=""
|
|
ENV VITE_SPACE_BASE_URL=$VITE_SPACE_BASE_URL
|
|
ARG VITE_SPACE_BASE_PATH="/spaces"
|
|
ENV VITE_SPACE_BASE_PATH=$VITE_SPACE_BASE_PATH
|
|
|
|
ARG VITE_LIVE_BASE_URL=""
|
|
ENV VITE_LIVE_BASE_URL=$VITE_LIVE_BASE_URL
|
|
ARG VITE_LIVE_BASE_PATH="/live"
|
|
ENV VITE_LIVE_BASE_PATH=$VITE_LIVE_BASE_PATH
|
|
|
|
ARG VITE_WEB_BASE_URL=""
|
|
ENV VITE_WEB_BASE_URL=$VITE_WEB_BASE_URL
|
|
ARG VITE_WEB_BASE_PATH=""
|
|
ENV VITE_WEB_BASE_PATH=$VITE_WEB_BASE_PATH
|
|
|
|
ARG VITE_WEBSITE_URL="https://plane.so"
|
|
ENV VITE_WEBSITE_URL=$VITE_WEBSITE_URL
|
|
ARG VITE_SUPPORT_EMAIL="[email protected]"
|
|
ENV VITE_SUPPORT_EMAIL=$VITE_SUPPORT_EMAIL
|
|
|
|
COPY .gitignore .gitignore
|
|
COPY --from=builder /app/out/json/ .
|
|
COPY --from=builder /app/out/pnpm-lock.yaml ./pnpm-lock.yaml
|
|
|
|
# Copy full directory structure before fetch to ensure all package.json files are available
|
|
COPY --from=builder /app/out/full/ .
|
|
COPY turbo.json turbo.json
|
|
|
|
# Fetch dependencies to cache store, then install offline with dev deps
|
|
RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store pnpm fetch --store-dir=/pnpm/store
|
|
RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store CI=true pnpm install --offline --frozen-lockfile --store-dir=/pnpm/store --prod=false
|
|
|
|
# Build only the admin package
|
|
RUN pnpm turbo run build --filter=admin
|
|
|
|
# =========================================================================== #
|
|
|
|
FROM registry.access.redhat.com/ubi10/nginx-126 AS production
|
|
|
|
COPY apps/admin/nginx/nginx.conf /etc/nginx/nginx.conf
|
|
COPY --from=installer /app/apps/admin/build/client /usr/share/nginx/html/god-mode
|
|
|
|
USER root
|
|
|
|
RUN dnf install -y crypto-policies crypto-policies-scripts && dnf clean all
|
|
RUN update-crypto-policies --set FIPS
|
|
|
|
COPY LICENSE.txt .
|
|
RUN mkdir -p /usr/share/licenses/plane/
|
|
COPY LICENSE.txt /usr/share/licenses/plane/LICENSE.txt
|
|
|
|
RUN mkdir -p /var/lib/nginx/tmp/client_body /var/log/nginx /var/cache/nginx && \
|
|
chown -R nginx:nginx /var/lib/nginx /var/log/nginx /var/cache/nginx /run
|
|
|
|
USER nginx
|
|
|
|
EXPOSE 3000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD curl -fsS http://127.0.0.1:3000/ >/dev/null || exit 1
|
|
|
|
CMD ["nginx", "-g", "daemon off;"]
|