hobokenchicken
44370f41e5
- .dockerignore excludes .git, node_modules, certs, *.zip - Dockerfile runs as non-root appuser - compose.yml isolates frontend (Caddy only) and backend (DB/cache/media) networks - deploy.sh snapshots binary before pull and rolls back on failed health check
26 lines
764 B
Docker
26 lines
764 B
Docker
FROM golang:1.26.4-alpine AS go-builder
|
|
WORKDIR /app
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY cmd/ cmd/
|
|
COPY internal/ internal/
|
|
COPY docs/ docs/
|
|
RUN CGO_ENABLED=0 GOOS=linux go build -o /bin/dumpster-server ./cmd/server
|
|
|
|
FROM node:22-alpine AS web-builder
|
|
WORKDIR /app
|
|
COPY web/package.json web/package-lock.json ./
|
|
RUN npm ci --include=dev
|
|
COPY web/ .
|
|
RUN npm run build
|
|
|
|
FROM alpine:latest
|
|
RUN apk --no-cache add ca-certificates
|
|
RUN adduser -D -g '' appuser
|
|
WORKDIR /app
|
|
COPY --from=go-builder /bin/dumpster-server /app/dumpster-server
|
|
COPY --from=web-builder /app/dist /srv/web
|
|
USER appuser
|
|
EXPOSE 8080
|
|
CMD sh -c "if [ -z \"$DUMPSTER_SECRET\" ]; then export DUMPSTER_SECRET=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c 32); fi; /app/dumpster-server"
|