mirror of
https://github.com/BradGroux/veritas-kanban.git
synced 2026-08-28 02:44:59 +00:00
2a581a451a
* fix: centralize runtime state paths * chore: realign reviewed secret fingerprint * test: cover legacy security migration * test: isolate centralized runtime paths * fix: address runtime path review findings * test: include runtime health in critical coverage * chore: realign deployment secret fingerprint * test: stabilize provider coverage * test: cover reflection job storage * test: secure health route temp files
122 lines
4.2 KiB
Docker
122 lines
4.2 KiB
Docker
# =============================================================================
|
|
# Veritas Kanban — Production Multi-Stage Dockerfile
|
|
# =============================================================================
|
|
# Stages:
|
|
# 1. deps — Install all workspace dependencies (shared cache layer)
|
|
# 2. build-shared — Build the shared package
|
|
# 3. build-web — Build React frontend with Vite
|
|
# 4. build-server — Compile Express server TypeScript
|
|
# 5. production — Minimal runtime image
|
|
#
|
|
# Target image size: < 200MB
|
|
# =============================================================================
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Stage 1: Install dependencies (shared across build stages)
|
|
# ---------------------------------------------------------------------------
|
|
FROM node:22-alpine AS deps
|
|
|
|
RUN corepack enable && corepack prepare pnpm@11.1.1 --activate
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy workspace config and lockfile first (better layer caching)
|
|
COPY pnpm-workspace.yaml package.json pnpm-lock.yaml ./
|
|
COPY shared/package.json ./shared/
|
|
COPY server/package.json ./server/
|
|
COPY web/package.json ./web/
|
|
COPY cli/package.json ./cli/
|
|
COPY mcp/package.json ./mcp/
|
|
COPY scripts/ ./scripts/
|
|
|
|
# Install all dependencies (dev + prod) for building
|
|
ENV HUSKY=0
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Stage 2: Build shared package
|
|
# ---------------------------------------------------------------------------
|
|
FROM deps AS build-shared
|
|
|
|
COPY shared/ ./shared/
|
|
RUN pnpm --filter @veritas-kanban/shared build
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Stage 3: Build frontend (Vite)
|
|
# ---------------------------------------------------------------------------
|
|
FROM build-shared AS build-web
|
|
|
|
# Optional: deploy under a sub-path (e.g., /kanban/) behind a reverse proxy.
|
|
# When set, all client-side routes and API calls are prefixed automatically.
|
|
ARG VITE_BASE_PATH=/
|
|
ENV VITE_BASE_PATH=${VITE_BASE_PATH}
|
|
|
|
COPY web/ ./web/
|
|
RUN pnpm --filter @veritas-kanban/web build
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Stage 4: Build server (TypeScript)
|
|
# ---------------------------------------------------------------------------
|
|
FROM build-shared AS build-server
|
|
|
|
COPY server/ ./server/
|
|
RUN pnpm --filter @veritas-kanban/server build
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Stage 5: Production runtime
|
|
# ---------------------------------------------------------------------------
|
|
FROM node:22-alpine AS production
|
|
|
|
RUN corepack enable && corepack prepare pnpm@11.1.1 --activate
|
|
|
|
# Security: run as non-root
|
|
RUN addgroup -g 1001 -S nodejs && \
|
|
adduser -S veritas -u 1001 -G nodejs
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy workspace config for pnpm (include real web/package.json for lockfile integrity)
|
|
COPY pnpm-workspace.yaml package.json pnpm-lock.yaml ./
|
|
COPY shared/package.json ./shared/
|
|
COPY server/package.json ./server/
|
|
COPY web/package.json ./web/
|
|
COPY cli/package.json ./cli/
|
|
COPY mcp/package.json ./mcp/
|
|
|
|
# Install production-only dependencies
|
|
# --ignore-scripts: skip husky prepare hook (not needed in container)
|
|
# Note: web deps get installed to satisfy the lockfile, but we remove them
|
|
# since the frontend is pre-built as static assets
|
|
RUN pnpm install --frozen-lockfile --prod --ignore-scripts && \
|
|
rm -rf web/node_modules && \
|
|
pnpm store prune
|
|
|
|
# Copy built artifacts
|
|
COPY --from=build-shared /app/shared/dist ./shared/dist
|
|
COPY --from=build-server /app/server/dist ./server/dist
|
|
COPY --from=build-web /app/web/dist ./web/dist
|
|
|
|
# Create the single volume-backed storage root. Runtime state is stored at
|
|
# /app/data/.veritas-kanban and task data at /app/data/tasks.
|
|
RUN mkdir -p /app/data && \
|
|
chown -R veritas:nodejs /app/data /app/server
|
|
|
|
# Switch to non-root user
|
|
USER veritas
|
|
|
|
# Environment defaults
|
|
ENV NODE_ENV=production
|
|
ENV PORT=3001
|
|
ENV DATA_DIR=/app/data
|
|
|
|
EXPOSE 3001
|
|
|
|
# Health check
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD wget --no-verbose --tries=1 --spider http://localhost:3001/health || exit 1
|
|
|
|
# The runtime path contract is independent of cwd when DATA_DIR is set.
|
|
WORKDIR /app/server
|
|
|
|
# Start server
|
|
CMD ["node", "dist/index.js"]
|