Files

116 lines
3.9 KiB
Docker

# syntax=docker/dockerfile:1
# Multi-stage Dockerfile for Next.js 16 production build (Node 20)
# - Does NOT bake secrets via ARG/ENV
# - Skips env validation during build (SKIP_ENV_VALIDATION=1 in builder only)
# - Enforces required secrets at runtime via entrypoint.sh
# Note: COOLIFY_URL and COOLIFY_FQDN build args are injected by Coolify but not used in this Dockerfile
############################
# Stage 1: Dependencies
############################
FROM node:20-alpine AS deps
WORKDIR /app
# Reduce noisy npm output in CI builds
ENV NPM_CONFIG_FUND=false
ENV NPM_CONFIG_AUDIT=false
ENV NPM_CONFIG_UPDATE_NOTIFIER=false
ENV NPM_CONFIG_LOGLEVEL=error
# Native deps (if you have any native modules)
# vips-dev is required for building sharp native binaries
# This is the ONLY stage that needs build tools - native modules are built here
# Additional packages needed for sharp to build from source if pre-built binaries aren't available
RUN echo "📦 Installing Alpine packages (build tools)..." && \
apk add --no-cache libc6-compat python3 make g++ vips-dev pkgconfig
# Copy lockfiles and Prisma schema (postinstall may need it)
# package-lock.json is required for npm ci (reproducible builds)
COPY package.json package-lock.json ./
COPY prisma ./prisma
# Install build tools globally for native modules (sharp needs these when building from source)
RUN npm install -g node-gyp node-addon-api
# Set environment variables to help sharp build properly
# SHARP_IGNORE_GLOBAL_LIBVIPS=1 tells sharp to use the system libvips we installed
ENV SHARP_IGNORE_GLOBAL_LIBVIPS=1
RUN echo "📥 Installing npm dependencies..." && \
npm ci --omit=dev --no-audit --no-fund --loglevel=error
############################
# Stage 2: Builder
############################
FROM node:20-alpine AS builder
WORKDIR /app
# Note: No build tools needed here - native modules are already built in deps stage
# Copying pre-built node_modules from deps stage (includes compiled native binaries)
COPY --from=deps /app/node_modules ./node_modules
COPY . .
# Generate Prisma Client for build (if your build imports Prisma)
RUN echo "🔧 Generating Prisma Client..." && \
npx prisma generate
ENV NEXT_TELEMETRY_DISABLED=1
ENV NODE_ENV=production
# IMPORTANT:
# Do not require secrets at build time; enforce at runtime instead.
ENV SKIP_ENV_VALIDATION=1
RUN echo "🔨 Building Next.js application..." && \
npm run build
############################
# Stage 3: Runner
############################
FROM node:20-alpine AS runner
WORKDIR /app
ENV NODE_ENV=production
ENV NEXT_TELEMETRY_DISABLED=1
ENV PORT=3000
ENV HOSTNAME="0.0.0.0"
# Runtime libraries for native dependencies:
# - sharp requires vips
# - prisma engines require openssl + libstdc++
RUN apk add --no-cache libc6-compat vips openssl ca-certificates libstdc++
# Non-root user
RUN addgroup --system --gid 1001 nodejs \
&& adduser --system --uid 1001 nextjs
# Runtime files
COPY --from=builder /app/public ./public
COPY --from=builder /app/.next/standalone ./
COPY --from=builder /app/.next/static ./.next/static
# Prisma migrations at startup require Prisma CLI + its full dependency tree.
# Copy the complete production node_modules (avoid chasing missing transitive deps).
# NOTE: this intentionally overwrites the minimal standalone node_modules.
COPY --from=deps /app/node_modules ./node_modules
# Prisma schema + migrations
COPY --from=builder /app/prisma ./prisma
COPY --from=builder /app/prisma.config.ts ./prisma.config.ts
# Add runtime env check entrypoint (no secrets baked)
COPY docker/entrypoint.sh /app/entrypoint.sh
RUN chmod +x /app/entrypoint.sh \
&& chown -R nextjs:nodejs /app
USER nextjs
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
CMD node -e "require('http').get('http://127.0.0.1:3000/api/health', (r) => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))"
CMD ["/app/entrypoint.sh"]