-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathDockerfile
More file actions
98 lines (76 loc) · 4.01 KB
/
Copy pathDockerfile
File metadata and controls
98 lines (76 loc) · 4.01 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
# ─────────────────────────────────────────────
# Stage 1: Build the Vite / React frontend
# ─────────────────────────────────────────────
FROM node:22-alpine AS frontend-builder
# pnpm via corepack — version pinned in root package.json ("packageManager")
RUN corepack enable
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
# patches/ es necesario: pnpm-workspace.yaml referencia un patchedDependency
# (react-native-css-interop) y `pnpm install --frozen-lockfile` falla con ENOENT
# si el archivo del patch no está en el contexto.
COPY patches/ ./patches/
COPY apps/web/package.json apps/web/
COPY packages/core/package.json packages/core/
RUN pnpm install --frozen-lockfile
COPY apps/web/ apps/web/
COPY packages/core/ packages/core/
# Empty → pocketbase.js falls back to window.location.origin
ARG VITE_POCKETBASE_URL=""
ENV VITE_POCKETBASE_URL=$VITE_POCKETBASE_URL
# Empty in dev (uses Vite proxy). In prod: absolute URL of the AI API service.
ARG VITE_AI_API_URL=""
ENV VITE_AI_API_URL=$VITE_AI_API_URL
# VAPID public key for Web Push subscriptions (baked into frontend JS)
ARG VITE_VAPID_PUBLIC_KEY=""
ENV VITE_VAPID_PUBLIC_KEY=$VITE_VAPID_PUBLIC_KEY
# Release de Sentry, única por deploy: `calistenia-app@<version>+<sha corto>`.
# Es solo un identificador, no un secreto, así que ARG normal. Vacío en un build
# local → vite.config.js cae al semver de package.json.
ARG SENTRY_RELEASE=""
ENV SENTRY_RELEASE=$SENTRY_RELEASE
# El token va como SECRET de buildkit, NO como ARG: un build-arg queda escrito
# en los metadatos de la imagen y `docker history` lo enseña. Montado así solo
# existe durante este RUN y no toca ninguna capa.
#
# `|| true` porque en un build sin el secreto (local, o un PR de un fork) el
# fichero no existe: el build debe seguir, y sentryVitePlugin se apaga solo al
# no ver token. Subir source maps NUNCA debe poder tumbar un deploy.
RUN --mount=type=secret,id=sentry_auth_token \
SENTRY_AUTH_TOKEN="$(cat /run/secrets/sentry_auth_token 2>/dev/null || true)" \
pnpm --filter @calistenia/web build
# ─────────────────────────────────────────────
# Stage 2: Download PocketBase
# ─────────────────────────────────────────────
FROM alpine:3.19 AS pb-downloader
# Mantener en sync con Dockerfile.pb-dev y el job e2e-smoke de ci.yml — el
# smoke E2E corre contra esta misma versión de PocketBase.
ARG PB_VERSION=0.36.8
RUN apk add --no-cache curl unzip \
&& curl -fsSL --retry 5 --retry-all-errors --retry-delay 3 \
"https://github.com/pocketbase/pocketbase/releases/download/v${PB_VERSION}/pocketbase_${PB_VERSION}_linux_amd64.zip" \
-o /tmp/pocketbase.zip \
&& unzip /tmp/pocketbase.zip -d /tmp/pb \
&& chmod +x /tmp/pb/pocketbase
# ─────────────────────────────────────────────
# Stage 3: Final runtime image
# ─────────────────────────────────────────────
FROM alpine:3.19
RUN apk add --no-cache ca-certificates wget
RUN adduser -D -u 1001 pbuser
WORKDIR /app
COPY --from=pb-downloader /tmp/pb/pocketbase ./pocketbase
COPY pb_migrations/ ./pb_migrations/
COPY pb_hooks/ ./pb_hooks/
COPY --from=frontend-builder /app/apps/web/dist ./pb_public
RUN mkdir -p /app/pb_data && chown -R pbuser:pbuser /app
USER pbuser
EXPOSE 8090
HEALTHCHECK --interval=10s --timeout=3s --start-period=5s \
CMD wget -qO- http://localhost:8090/api/health || exit 1
CMD ["./pocketbase", "serve", \
"--http=0.0.0.0:8090", \
"--dir=/app/pb_data", \
"--migrationsDir=/app/pb_migrations", \
"--hooksDir=/app/pb_hooks", \
"--publicDir=/app/pb_public"]