shadowcheck-web/Dockerfile at master · cyclonite69/shadowcheck-web · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
# Multi-stage build for optimized production image
FROM node:25.9.0-alpine AS builder

# Set working directory
WORKDIR /app

# Prevent Husky from running during install in container builds
ENV HUSKY=0

# Ensure devDependencies are available for the build step
ENV NODE_ENV=development \
    NPM_CONFIG_PRODUCTION=false \
    NPM_CONFIG_OMIT=

# Copy package files
COPY package*.json ./

# Install dependencies (including devDependencies for build)
RUN npm ci --include=dev --legacy-peer-deps

# Copy application files
COPY . .

# Build frontend and server
RUN npm run build

# Remove development dependencies
RUN npm prune --omit=dev --legacy-peer-deps

###########################################
# Production image
###########################################
FROM node:25.9.0-alpine

# Install dumb-init for proper signal handling, pg_dump for backups, AWS CLI for S3, and Docker CLI for PgAdmin management
RUN apk add --no-cache dumb-init postgresql-client aws-cli docker-cli docker-cli-compose su-exec curl

# Install dependencies: gcompat provides the glibc compatibility layer needed for the binary
RUN apk add --no-cache curl rpm gcompat

# Install AWS SSM Session Manager Plugin
RUN ARCH=$(uname -m) && \
    if [ "$ARCH" = "x86_64" ]; then \
        SSM_URL="https://s3.amazonaws.com/session-manager-downloads/plugin/latest/linux_64bit/session-manager-plugin.rpm"; \
    elif [ "$ARCH" = "aarch64" ]; then \
        SSM_URL="https://s3.amazonaws.com/session-manager-downloads/plugin/latest/linux_arm64/session-manager-plugin.rpm"; \
    else \
        echo "Unsupported architecture: $ARCH"; exit 1; \
    fi && \
    curl -sL "$SSM_URL" -o /tmp/ssm.rpm && \
    cd /tmp && rpm2cpio ssm.rpm | cpio -idmv && \
    mkdir -p /usr/local/sessionmanagerplugin && \
    mv /tmp/usr/local/sessionmanagerplugin/* /usr/local/sessionmanagerplugin/ && \
    ln -s /usr/local/sessionmanagerplugin/bin/session-manager-plugin /usr/local/bin/session-manager-plugin && \
    chmod +x /usr/local/sessionmanagerplugin/bin/session-manager-plugin && \
    rm -rf /tmp/* && \
    apk del rpm

# Create app user for security
RUN addgroup -g 1001 -S nodejs && \
    adduser -S nodejs -u 1001 -h /home/nodejs && \
    mkdir -p /home/nodejs/.aws && \
    chown -R nodejs:nodejs /home/nodejs

# Set working directory
WORKDIR /app

# Copy package files and installed dependencies from builder
COPY --from=builder --chown=nodejs:nodejs /app/node_modules ./node_modules
COPY --from=builder --chown=nodejs:nodejs /app/package*.json ./
COPY --from=builder --chown=nodejs:nodejs /app/dist ./dist/

# Copy application code and built frontend
COPY --chown=nodejs:nodejs server ./server/
COPY --chown=nodejs:nodejs scripts ./scripts/
COPY --chown=nodejs:nodejs scripts/manual-ingest.js ./scripts/manual-ingest.js
COPY --chown=nodejs:nodejs sql ./sql/
COPY --chown=nodejs:nodejs docker/infrastructure ./docker/infrastructure/
COPY --chown=root:root docker/entrypoint.sh /entrypoint.sh

# Create directories for data and logs with proper ownership
RUN mkdir -p data/logs data/csv && \
    chown -R nodejs:nodejs /app && \
    chmod +x /entrypoint.sh

# Don't switch to nodejs user yet - entrypoint needs to run as root first
# USER nodejs will be handled by entrypoint via su-exec after setting up Docker socket permissions

# Set production environment
ENV NODE_ENV=production \
    HOME=/home/nodejs

# Expose port
EXPOSE 3001

# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=40s --retries=3 \
  CMD curl -fsS http://127.0.0.1:3001/health >/dev/null || exit 1

# Use entrypoint to handle Docker socket permissions, then dumb-init for signals
ENTRYPOINT ["/entrypoint.sh"]

# Start application with compiled server
CMD ["node", "dist/server/server/server.js"]