maaz519
a520b26398
Adds a multi-stage Dockerfile for iios-service (build → pnpm deploy prune → slim non-root runtime), a docker-entrypoint that runs `prisma migrate deploy` then starts the server as PID 1, a .dockerignore, a fully-commented .env.example config contract, and docs/DEPLOYMENT.md (topology, scaling, release strategy, prod-readiness gaps). Moves prisma to dependencies so the CLI ships in the prod bundle. Image builds, migrates, and serves /health 200. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
55 lines
2.5 KiB
Docker
55 lines
2.5 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# Production image for @insignia/iios-service (the single IIOS backend).
|
|
# Build context MUST be the monorepo ROOT (it needs the workspace + lockfile):
|
|
# docker build -f packages/iios-service/Dockerfile -t iios-service:latest .
|
|
#
|
|
# Multi-stage: (1) build the service + its workspace deps and prune to a
|
|
# self-contained prod bundle via `pnpm deploy`; (2) a slim runtime that only
|
|
# carries that bundle. Migrations run at container start (see docker-entrypoint.sh).
|
|
|
|
ARG NODE_VERSION=22-bookworm-slim
|
|
ARG PNPM_VERSION=10.6.2
|
|
|
|
# ── build ───────────────────────────────────────────────────────────────────
|
|
FROM node:${NODE_VERSION} AS build
|
|
ARG PNPM_VERSION
|
|
ENV PNPM_HOME=/pnpm PATH=/pnpm:$PATH
|
|
# openssl + ca-certificates are required by Prisma's engine on debian-slim.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends openssl ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
RUN corepack enable && corepack prepare pnpm@${PNPM_VERSION} --activate
|
|
|
|
WORKDIR /repo
|
|
COPY . .
|
|
|
|
# Full install (needs devDeps to compile), then build ONLY the service + its
|
|
# workspace dependencies, generate the Prisma client, and emit a pruned prod bundle.
|
|
RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
|
|
pnpm install --frozen-lockfile
|
|
# Generate the Prisma client BEFORE compiling — nest build (tsc) needs its types,
|
|
# otherwise Prisma results are `any` and noImplicitAny fails the build.
|
|
RUN pnpm --filter @insignia/iios-service exec prisma generate \
|
|
&& pnpm --filter "@insignia/iios-service..." build \
|
|
&& pnpm --filter @insignia/iios-service --prod --legacy deploy /app
|
|
|
|
# ── runtime ──────────────────────────────────────────────────────────────────
|
|
FROM node:${NODE_VERSION} AS runtime
|
|
ENV NODE_ENV=production
|
|
# Prisma engine needs openssl at runtime too.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends openssl ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /app
|
|
COPY --from=build /app ./
|
|
# Regenerate the Prisma client against the final filesystem (deterministic).
|
|
RUN node_modules/.bin/prisma generate
|
|
|
|
# Run as the built-in non-root `node` user.
|
|
RUN chmod +x docker-entrypoint.sh && chown -R node:node /app
|
|
USER node
|
|
|
|
EXPOSE 3200
|
|
ENV PORT=3200
|
|
# migrate deploy → start; see docker-entrypoint.sh.
|
|
ENTRYPOINT ["./docker-entrypoint.sh"]
|