149 lines
3.6 KiB
Docker
149 lines
3.6 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
ARG NODE_IMAGE=node:24.18.0-bookworm-slim
|
|
|
|
# ============================================================
|
|
# 1. Dependencias reproducibles
|
|
# ============================================================
|
|
FROM ${NODE_IMAGE} AS deps
|
|
|
|
WORKDIR /app
|
|
|
|
ENV NEXT_TELEMETRY_DISABLED=1 \
|
|
NPM_CONFIG_REGISTRY=https://registry.npmjs.org/ \
|
|
NPM_CONFIG_REPLACE_REGISTRY_HOST=always \
|
|
NPM_CONFIG_AUDIT=false \
|
|
NPM_CONFIG_FUND=false \
|
|
NPM_CONFIG_FETCH_RETRIES=2 \
|
|
NPM_CONFIG_FETCH_RETRY_MINTIMEOUT=5000 \
|
|
NPM_CONFIG_FETCH_RETRY_MAXTIMEOUT=30000 \
|
|
NPM_CONFIG_FETCH_TIMEOUT=120000 \
|
|
NPM_CONFIG_MAXSOCKETS=8 \
|
|
NPM_CONFIG_LOGLEVEL=info
|
|
|
|
COPY package.json package-lock.json .npmrc ./
|
|
|
|
# Evita que un package-lock generado en otro entorno apunte a un
|
|
# registry privado o inaccesible para el runner de Gitea.
|
|
RUN node <<'NODE'
|
|
const fs = require("node:fs");
|
|
|
|
const file = "package-lock.json";
|
|
const text = fs.readFileSync(file, "utf8");
|
|
|
|
const forbiddenHosts = [
|
|
"internal.api.openai.org",
|
|
"packages.applied-caas-gateway1",
|
|
];
|
|
|
|
const detected = forbiddenHosts.filter((host) => text.includes(host));
|
|
|
|
if (detected.length > 0) {
|
|
console.error(
|
|
`ERROR: package-lock.json contiene registry no permitido: ${detected.join(", ")}`
|
|
);
|
|
process.exit(1);
|
|
}
|
|
|
|
const lock = JSON.parse(text);
|
|
console.log(
|
|
`Lockfile válido: ${lock.name} · lockfileVersion=${lock.lockfileVersion}`
|
|
);
|
|
NODE
|
|
|
|
RUN node --version \
|
|
&& npm --version \
|
|
&& npm config get registry \
|
|
&& npm config get replace-registry-host \
|
|
&& npm ping
|
|
|
|
# --kill-after garantiza que un npm colgado termine después de SIGTERM.
|
|
RUN --mount=type=cache,target=/root/.npm,sharing=private \
|
|
timeout \
|
|
--signal=TERM \
|
|
--kill-after=30s \
|
|
900s \
|
|
npm ci \
|
|
--no-audit \
|
|
--no-fund \
|
|
--prefer-online \
|
|
--loglevel=info \
|
|
--timing
|
|
|
|
|
|
# ============================================================
|
|
# 2. Compilación de Next.js
|
|
# ============================================================
|
|
FROM ${NODE_IMAGE} AS builder
|
|
|
|
WORKDIR /app
|
|
|
|
ENV NODE_ENV=production \
|
|
NEXT_TELEMETRY_DISABLED=1 \
|
|
NODE_OPTIONS=--max-old-space-size=2048
|
|
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY . .
|
|
|
|
RUN --mount=type=cache,target=/app/.next/cache,sharing=private \
|
|
npm run build
|
|
|
|
RUN test -f /app/.next/standalone/server.js
|
|
|
|
|
|
# ============================================================
|
|
# 3. Runtime de producción
|
|
# ============================================================
|
|
FROM ${NODE_IMAGE} AS runner
|
|
|
|
WORKDIR /app
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive \
|
|
NODE_ENV=production \
|
|
NEXT_TELEMETRY_DISABLED=1 \
|
|
HOSTNAME=0.0.0.0 \
|
|
PORT=80
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
libcap2-bin \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& groupadd --gid 1001 nodejs \
|
|
&& useradd \
|
|
--uid 1001 \
|
|
--gid 1001 \
|
|
--create-home \
|
|
--shell /usr/sbin/nologin \
|
|
nextjs \
|
|
&& setcap 'cap_net_bind_service=+ep' \
|
|
/usr/local/bin/node
|
|
|
|
COPY --from=builder \
|
|
--chown=nextjs:nodejs \
|
|
/app/public \
|
|
./public
|
|
|
|
COPY --from=builder \
|
|
--chown=nextjs:nodejs \
|
|
/app/.next/standalone \
|
|
./
|
|
|
|
COPY --from=builder \
|
|
--chown=nextjs:nodejs \
|
|
/app/.next/static \
|
|
./.next/static
|
|
|
|
USER nextjs
|
|
|
|
EXPOSE 80
|
|
|
|
HEALTHCHECK \
|
|
--interval=30s \
|
|
--timeout=8s \
|
|
--start-period=30s \
|
|
--retries=3 \
|
|
CMD ["node", "-e", "fetch('http://127.0.0.1/api/health').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]
|
|
|
|
CMD ["node", "server.js"]
|