mirror of
https://github.com/suitenumerique/docs.git
synced 2026-09-26 11:35:05 +02:00
Anthony LCandManuel Raynaud
a80fe1aded
Every other package in this repository is installed with yarn; yhub-server was the only one on npm, with its own package-lock.json. To ensure consistency it now uses yarn like the rest of the project. package-lock.json is replaced by yarn.lock, a packageManager field is added, and the Dockerfile, CI workflow, Makefile, helm init-db job and the documentation move from `npm ci` / `npm run init-db` to `yarn install --frozen-lockfile` / `yarn init-db`.
58 lines
2.0 KiB
Docker
58 lines
2.0 KiB
Docker
# trixie for glibc >= 2.38 — uws prebuilt binaries reject bookworm's 2.36
|
|
FROM node:22-trixie AS base
|
|
|
|
WORKDIR /app
|
|
|
|
# built from the repository root, like every other image here — the entrypoint
|
|
# below lives outside this directory
|
|
COPY ./src/yhub-server/package.json ./src/yhub-server/yarn.lock ./
|
|
|
|
|
|
# ---- Development image ----
|
|
FROM base AS yhub-development
|
|
|
|
# dev dependencies included: nodemon, plus this is where one-off scripts run
|
|
# (`make migrate-yhub` runs `yarn init-db` in it)
|
|
RUN yarn install --frozen-lockfile
|
|
|
|
# server.js, migration.js, env.js — glob so a new module cannot be forgotten.
|
|
# compose bind-mounts the sources over /app on top of this copy, so an edit on
|
|
# the host is seen immediately; the copy keeps the image usable on its own.
|
|
COPY ./src/yhub-server/*.js ./
|
|
|
|
EXPOSE 3002
|
|
|
|
# `yarn dev` restarts the server on every source change, no rebuild needed.
|
|
# nodemon rather than node's own --watch: the latter watches inodes, so it goes
|
|
# deaf as soon as a file is replaced by a rename — which is what `git checkout`
|
|
# and most editors do when saving.
|
|
CMD ["yarn", "dev"]
|
|
|
|
|
|
# ---- Production image ----
|
|
FROM base AS yhub
|
|
|
|
RUN yarn install --frozen-lockfile --production
|
|
|
|
COPY ./src/yhub-server/*.js ./
|
|
|
|
EXPOSE 3002
|
|
|
|
# Same entrypoint as the other services: it gives the container user an entry in
|
|
# /etc/passwd, which an arbitrary uid (kubernetes runAsUser) does not have. The
|
|
# group needs the same rights as the owner on /etc/passwd for it to write there.
|
|
COPY ./docker/files/usr/local/bin/entrypoint /usr/local/bin/entrypoint
|
|
RUN chmod g=u /etc/passwd
|
|
|
|
# Un-privileged user running the application. The server writes nothing outside
|
|
# stdout, so it needs no home and no writable path. Defaulted, unlike the other
|
|
# images of this repository: the helm chart runs the pod with runAsNonRoot, and
|
|
# a build that forgot the argument would produce an image kubernetes refuses to
|
|
# start.
|
|
ARG DOCKER_USER=1000
|
|
USER ${DOCKER_USER}
|
|
|
|
ENTRYPOINT [ "/usr/local/bin/entrypoint" ]
|
|
|
|
CMD ["node", "server.js"]
|