1709a6c516
* chore: update workflow actions and docker build secrets * fix: preserve existing mise config * chore: update build-push action to version 1.5.1 across workflows * chore: use @major action versions and guard Dockerfile secret exports - Switch all GitHub Actions from pinned versions (@v4.2.1) to major tags (@v4) per GitHub convention. - Guard /run/secrets/ exports in Dockerfiles with '[ -s ... ]' checks so missing optional secrets don't export empty env vars. Amp-Thread-ID: https://ampcode.com/threads/T-019d4b84-83d7-7455-b971-e5639998ef4f Co-authored-by: Amp <[email protected]> --------- Co-authored-by: akshat5302 <[email protected]> Co-authored-by: Amp <[email protected]>
121 lines
4.2 KiB
Docker
121 lines
4.2 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
FROM node:22-alpine AS base
|
|
|
|
# Setup pnpm package manager with corepack and configure global bin directory for caching
|
|
ENV PNPM_HOME="/pnpm"
|
|
ENV PATH="$PNPM_HOME:$PATH"
|
|
RUN corepack enable
|
|
|
|
# *****************************************************************************
|
|
# STAGE 1: Build the project
|
|
# *****************************************************************************
|
|
FROM base AS builder
|
|
RUN apk add --no-cache libc6-compat
|
|
# Set working directory
|
|
WORKDIR /app
|
|
|
|
ARG TURBO_VERSION=2.8.21
|
|
RUN corepack enable pnpm && pnpm add -g turbo@${TURBO_VERSION}
|
|
COPY . .
|
|
|
|
RUN turbo prune --scope=web --docker
|
|
|
|
# *****************************************************************************
|
|
# STAGE 2: Install dependencies & build the project
|
|
# *****************************************************************************
|
|
# Add lockfile and package.json's of isolated subworkspace
|
|
FROM base AS installer
|
|
|
|
RUN apk add --no-cache libc6-compat
|
|
WORKDIR /app
|
|
|
|
# First install the dependencies (as they change less often)
|
|
COPY .gitignore .gitignore
|
|
COPY --from=builder /app/out/json/ .
|
|
COPY --from=builder /app/out/pnpm-lock.yaml ./pnpm-lock.yaml
|
|
RUN corepack enable pnpm
|
|
|
|
# Copy full directory structure before fetch to ensure all package.json files are available
|
|
COPY --from=builder /app/out/full/ .
|
|
COPY turbo.json turbo.json
|
|
|
|
# Fetch dependencies to cache store, then install offline with dev deps
|
|
RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store pnpm fetch --store-dir=/pnpm/store
|
|
RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store CI=true pnpm install --offline --frozen-lockfile --store-dir=/pnpm/store
|
|
|
|
ARG VITE_API_BASE_URL=""
|
|
ENV VITE_API_BASE_URL=$VITE_API_BASE_URL
|
|
|
|
ARG VITE_ADMIN_BASE_URL=""
|
|
ENV VITE_ADMIN_BASE_URL=$VITE_ADMIN_BASE_URL
|
|
|
|
ARG VITE_ADMIN_BASE_PATH="/god-mode/"
|
|
ENV VITE_ADMIN_BASE_PATH=$VITE_ADMIN_BASE_PATH
|
|
|
|
ARG VITE_LIVE_BASE_URL=""
|
|
ENV VITE_LIVE_BASE_URL=$VITE_LIVE_BASE_URL
|
|
|
|
ARG VITE_LIVE_BASE_PATH="/live"
|
|
ENV VITE_LIVE_BASE_PATH=$VITE_LIVE_BASE_PATH
|
|
|
|
ARG VITE_SPACE_BASE_URL=""
|
|
ENV VITE_SPACE_BASE_URL=$VITE_SPACE_BASE_URL
|
|
|
|
ARG VITE_SPACE_BASE_PATH="/spaces"
|
|
ENV VITE_SPACE_BASE_PATH=$VITE_SPACE_BASE_PATH
|
|
|
|
ARG VITE_WEB_BASE_URL=""
|
|
ENV VITE_WEB_BASE_URL=$VITE_WEB_BASE_URL
|
|
|
|
ARG VITE_SILO_BASE_URL=""
|
|
ENV VITE_SILO_BASE_URL=$VITE_SILO_BASE_URL
|
|
|
|
ARG VITE_SILO_BASE_PATH="/silo"
|
|
ENV VITE_SILO_BASE_PATH=$VITE_SILO_BASE_PATH
|
|
|
|
ARG VITE_PI_BASE_URL=""
|
|
ENV VITE_PI_BASE_URL=$VITE_PI_BASE_URL
|
|
|
|
ARG VITE_PI_BASE_PATH="/pi"
|
|
ENV VITE_PI_BASE_PATH=$VITE_PI_BASE_PATH
|
|
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
ENV TURBO_TELEMETRY_DISABLED=1
|
|
|
|
RUN --mount=type=secret,id=TURBO_TOKEN,required=false \
|
|
--mount=type=secret,id=TURBO_REMOTE_CACHE_SIGNATURE_KEY,required=false \
|
|
--mount=type=secret,id=SENTRY_AUTH_TOKEN,required=false \
|
|
sh -ec 'if [ -s /run/secrets/TURBO_TOKEN ]; then export TURBO_TOKEN="$(cat /run/secrets/TURBO_TOKEN)"; fi; \
|
|
if [ -s /run/secrets/TURBO_REMOTE_CACHE_SIGNATURE_KEY ]; then export TURBO_REMOTE_CACHE_SIGNATURE_KEY="$(cat /run/secrets/TURBO_REMOTE_CACHE_SIGNATURE_KEY)"; fi; \
|
|
if [ -s /run/secrets/SENTRY_AUTH_TOKEN ]; then export SENTRY_AUTH_TOKEN="$(cat /run/secrets/SENTRY_AUTH_TOKEN)"; fi; \
|
|
NODE_OPTIONS="--max-old-space-size=6144" pnpm turbo run build --filter=web'
|
|
|
|
# *****************************************************************************
|
|
# STAGE 3: Serve with nginx
|
|
# *****************************************************************************
|
|
FROM registry.access.redhat.com/ubi10/nginx-126 AS production
|
|
|
|
COPY apps/web/nginx/nginx.conf /etc/nginx/nginx.conf
|
|
COPY --from=installer /app/apps/web/build/client /usr/share/nginx/html
|
|
|
|
USER root
|
|
|
|
RUN dnf install -y crypto-policies crypto-policies-scripts && dnf clean all
|
|
RUN update-crypto-policies --set FIPS
|
|
|
|
COPY LICENSE.txt .
|
|
RUN mkdir -p /usr/share/licenses/plane/
|
|
COPY LICENSE.txt /usr/share/licenses/plane/LICENSE.txt
|
|
|
|
RUN mkdir -p /var/lib/nginx/tmp/client_body /var/log/nginx /var/cache/nginx /run && \
|
|
chown -R nginx:nginx /var/lib/nginx /var/log/nginx /var/cache/nginx /run
|
|
|
|
USER nginx
|
|
|
|
EXPOSE 3000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD curl -fsS http://127.0.0.1:3000/ >/dev/null || exit 1
|
|
|
|
CMD ["nginx", "-g", "daemon off;"]
|