containerforge/apps/drydock/Dockerfile at ba9bd8495d653573af102062ce003537c23be50b · trueforge-org/containerforge · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
# Base stage - install system dependencies
FROM ghcr.io/trueforge-org/node:24.14.1@sha256:d823f0ad31f49d9944d39857b673a0aef31e9d6edbff53b855d7a1f1b63512f6 AS base

USER root

ARG VERSION
ARG TARGETARCH

ENV WORKDIR=/app
ENV DD_LOG_FORMAT=text
ENV DD_VERSION=$VERSION

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

WORKDIR /app

# Install additional system packages (bash, curl, git, jq, openssl, tini, tzdata already in base)
# hadolint ignore=DL3008
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        gosu \
    && rm -rf /var/lib/apt/lists/*

# Install trivy and cosign
RUN ARCH=${TARGETARCH:-amd64} && \
    TRIVY_ARCH=$([ "$ARCH" = "arm64" ] && echo "ARM64" || echo "64bit") && \
    curl -fsSL "https://github.com/aquasecurity/trivy/releases/download/v0.69.1/trivy_0.69.1_Linux-${TRIVY_ARCH}.tar.gz" \
        | tar xz -C /usr/local/bin trivy && \
    curl -fsSL "https://github.com/sigstore/cosign/releases/download/v2.4.1/cosign-linux-${ARCH}" -o /usr/local/bin/cosign && \
    chmod +x /usr/local/bin/cosign && \
    mkdir -p /config && \
    chown -R apps:apps /app /config && chmod -R 755 /app /config && \
    rm -rf /tmp/*

# Build stage for backend app
FROM base AS app-build

USER root

RUN mkdir -p /app/src && \
    curl -fsSL "https://github.com/trueforge-org/drydock/archive/refs/tags/${VERSION}.tar.gz" \
        | tar xzf - -C /app/src --strip-components=1

WORKDIR /app/src/app

# Install dependencies (including dev)
RUN npm ci --include=dev --omit=optional --no-audit --no-fund --no-update-notifier

# Build and remove dev dependencies
RUN npm run build && \
    npm prune --omit=dev

# Build stage for frontend UI
FROM base AS ui-build

USER root

RUN mkdir -p /app/src && \
    curl -fsSL "https://github.com/trueforge-org/drydock/archive/refs/tags/${VERSION}.tar.gz" \
        | tar xzf - -C /app/src --strip-components=1

WORKDIR /app/src/ui

# Install ui dependencies
RUN npm ci --no-audit --no-fund --no-update-notifier

# Build static assets
RUN npm run build

# Release stage
FROM base AS release

ARG VERSION

USER root

# Copy startup script
COPY --chmod=0775 start.sh /

# Copy node_modules from app-build
COPY --from=app-build /app/src/app/node_modules /app/node_modules

# Copy app (dist)
COPY --from=app-build /app/src/app/dist /app/dist
COPY --from=app-build /app/src/app/package.json /app/package.json

# Copy ui
COPY --from=ui-build /app/src/ui/dist /app/ui

USER apps
COPY --chmod=0755 . /

ENV WORKDIR=/app \
    DD_LOG_FORMAT=text \
    DD_VERSION=$VERSION \
    DD_STORE_PATH=/config

WORKDIR /app

CMD ["node", "dist/index.js"]