serene-pub/Dockerfile

58 lines
1.9 KiB
Docker

# ============================================================
# Stage 1 — Build
# ============================================================
FROM node:24-alpine AS builder
WORKDIR /app
# Install deps first (layer-cached until package files change)
COPY package.json ./
RUN npm install --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000
# Copy source and build
COPY . .
RUN npm run build
# Prune to production-only node_modules
RUN npm prune --production
# ============================================================
# Stage 2 — Runtime
# ============================================================
# Debian slim (glibc), not alpine: onnxruntime-node's prebuilt native binary
# (used by @huggingface/transformers for local embeddings) has no musl build
# and fails to dlopen on Alpine with "Error loading shared library
# ld-linux-x86-64.so.2".
FROM node:24-bookworm-slim
WORKDIR /app
# Defaults — all overridable at runtime via environment variables
ENV NODE_ENV=production \
PORT=3000 \
SOCKETS_PORT=3001 \
SERENE_PUB_DATA_DIR=/data \
# Disable auto-open in container environments
SERENE_AUTO_OPEN=1
# Copy only what's needed to run
COPY --from=builder /app/build ./build
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/drizzle ./drizzle
COPY --from=builder /app/package.json ./
# Run as a non-root user rather than the container default (root) — limits
# blast radius if the app process is ever compromised. /data is created (and
# owned) here, before VOLUME, so a fresh anonymous/named volume inherits the
# right ownership instead of defaulting to root.
RUN groupadd -r serene && useradd -r -g serene -d /app serene \
&& mkdir -p /data \
&& chown -R serene:serene /app /data
USER serene
# Persistent data volume (database, uploads, model cache, etc.)
VOLUME ["/data"]
EXPOSE 3000 3001
CMD ["node", "build/index.js"]