konnosDockerfile51 lines · main
| 1 | # syntax=docker/dockerfile:1.7 |
| 2 | # Base = oven/bun:1.3 (Debian by default; the `-alpine` tag we previously used |
| 3 | # is musl + busybox sh, which breaks libpg-query's native build chain — see |
| 4 | # apps/web/Dockerfile for the full rationale). |
| 5 | FROM oven/bun:1.3 AS base |
| 6 | RUN apt-get update -qq && \ |
| 7 | apt-get install -y --no-install-recommends \ |
| 8 | git python3 ca-certificates build-essential nodejs npm && \ |
| 9 | rm -rf /var/lib/apt/lists/* && \ |
| 10 | update-ca-certificates |
| 11 | RUN npm install -g pnpm@9.12.0 |
| 12 | |
| 13 | FROM base AS build |
| 14 | WORKDIR /repo |
| 15 | COPY . . |
| 16 | RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store \ |
| 17 | pnpm install --frozen-lockfile |
| 18 | |
| 19 | FROM oven/bun:1.3 AS runtime |
| 20 | WORKDIR /app |
| 21 | ENV NODE_ENV=production |
| 22 | ENV BRIVEN_API_PORT=3001 |
| 23 | # MinIO client (mc) — services/minio-admin.ts shells out to it to create |
| 24 | # per-project buckets + scoped service-account keys. Arch-matched binary. |
| 25 | # Placed BEFORE the build-identity ARG/ENV block below: those args (BUILD_SHA/ |
| 26 | # BUILD_AT) change on every commit and would otherwise bust the cache for this |
| 27 | # heavy download+chmod on every build. Keeping it here lands it in a stable |
| 28 | # cached layer that only re-runs when the base image changes. |
| 29 | RUN apt-get update -qq && apt-get install -y --no-install-recommends curl ca-certificates && \ |
| 30 | ARCH="$(dpkg --print-architecture)" && \ |
| 31 | curl -fsSL "https://dl.min.io/client/mc/release/linux-${ARCH}/mc" -o /usr/local/bin/mc && \ |
| 32 | chmod +x /usr/local/bin/mc && \ |
| 33 | rm -rf /var/lib/apt/lists/* |
| 34 | # Optional build-time identity. Compose can pass these via: |
| 35 | # build: |
| 36 | # context: ../.. |
| 37 | # dockerfile: apps/api/Dockerfile |
| 38 | # args: |
| 39 | # BRIVEN_BUILD_SHA: ${BRIVEN_BUILD_SHA} |
| 40 | # BRIVEN_BUILD_AT: ${BRIVEN_BUILD_AT} |
| 41 | # When unset, /info just reports "dev" — never 500s. |
| 42 | ARG BRIVEN_BUILD_SHA=dev |
| 43 | ARG BRIVEN_BUILD_AT=dev |
| 44 | ENV BRIVEN_BUILD_SHA=${BRIVEN_BUILD_SHA} |
| 45 | ENV BRIVEN_BUILD_AT=${BRIVEN_BUILD_AT} |
| 46 | RUN groupadd -r app && useradd -r -g app app |
| 47 | COPY --from=build --chown=app:app /repo /app |
| 48 | USER app |
| 49 | EXPOSE 3001 |
| 50 | WORKDIR /app/apps/api |
| 51 | CMD ["sh", "/app/apps/api/scripts/start.sh"] |