mirror of
https://github.com/suitenumerique/docs.git
synced 2026-09-24 02:25:08 +02:00
Manuel Raynaud
59a6be435d
The new infra we have must be configured in the helm chart. This commit all the missing templates to deploy yhub, it also automate the creation of the private keys needed by all services.
58 lines
2.0 KiB
Docker
58 lines
2.0 KiB
Docker
# trixie for glibc >= 2.38 — uws prebuilt binaries reject bookworm's 2.36
|
|
FROM node:22-trixie AS base
|
|
|
|
WORKDIR /app
|
|
|
|
# built from the repository root, like every other image here — the entrypoint
|
|
# below lives outside this directory
|
|
COPY ./src/yhub-server/package.json ./src/yhub-server/package-lock.json ./
|
|
|
|
|
|
# ---- Development image ----
|
|
FROM base AS yhub-development
|
|
|
|
# dev dependencies included: nodemon, plus this is where one-off scripts run
|
|
# (`make migrate-yhub` runs `npm run init-db` in it)
|
|
RUN npm ci
|
|
|
|
# server.js, migration.js, env.js — glob so a new module cannot be forgotten.
|
|
# compose bind-mounts the sources over /app on top of this copy, so an edit on
|
|
# the host is seen immediately; the copy keeps the image usable on its own.
|
|
COPY ./src/yhub-server/*.js ./
|
|
|
|
EXPOSE 3002
|
|
|
|
# `npm run dev` restarts the server on every source change, no rebuild needed.
|
|
# nodemon rather than node's own --watch: the latter watches inodes, so it goes
|
|
# deaf as soon as a file is replaced by a rename — which is what `git checkout`
|
|
# and most editors do when saving.
|
|
CMD ["npm", "run", "dev"]
|
|
|
|
|
|
# ---- Production image ----
|
|
FROM base AS yhub
|
|
|
|
RUN npm ci --omit=dev
|
|
|
|
COPY ./src/yhub-server/*.js ./
|
|
|
|
EXPOSE 3002
|
|
|
|
# Same entrypoint as the other services: it gives the container user an entry in
|
|
# /etc/passwd, which an arbitrary uid (kubernetes runAsUser) does not have. The
|
|
# group needs the same rights as the owner on /etc/passwd for it to write there.
|
|
COPY ./docker/files/usr/local/bin/entrypoint /usr/local/bin/entrypoint
|
|
RUN chmod g=u /etc/passwd
|
|
|
|
# Un-privileged user running the application. The server writes nothing outside
|
|
# stdout, so it needs no home and no writable path. Defaulted, unlike the other
|
|
# images of this repository: the helm chart runs the pod with runAsNonRoot, and
|
|
# a build that forgot the argument would produce an image kubernetes refuses to
|
|
# start.
|
|
ARG DOCKER_USER=1000
|
|
USER ${DOCKER_USER}
|
|
|
|
ENTRYPOINT [ "/usr/local/bin/entrypoint" ]
|
|
|
|
CMD ["node", "server.js"]
|