cesnimda
9088dcffb9
- site image: multi-stage node build -> unprivileged nginx (non-root, read-only) - nginx: CSP + security headers, immutable asset caching, revalidated HTML, canonical trailing slash, preserved /Linkedin 301, legacy-WP 410s, custom 404 - externalise theme-init so CSP uses script-src 'self' (no inline hash) - prod + dev compose; .env.example; relay Dockerfile fixed (image ships app user) - Gitea Actions: quality, e2e, lighthouse budgets, relay build, image push on main - verified: both images build; relay healthz 200; site serves EN/NO with CSP + redirect Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
23 lines
630 B
Docker
23 lines
630 B
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# ---- build ----
|
|
FROM mcr.microsoft.com/dotnet/sdk:9.0-alpine AS build
|
|
WORKDIR /src
|
|
COPY ContactRelay.csproj .
|
|
RUN dotnet restore
|
|
COPY . .
|
|
RUN dotnet publish -c Release -o /app --no-restore
|
|
|
|
# ---- runtime ----
|
|
FROM mcr.microsoft.com/dotnet/aspnet:9.0-alpine AS final
|
|
WORKDIR /app
|
|
COPY --from=build /app .
|
|
# The .NET aspnet image ships a non-root `app` user.
|
|
USER app
|
|
ENV ASPNETCORE_URLS=http://+:8081 \
|
|
DOTNET_EnableDiagnostics=0
|
|
EXPOSE 8081
|
|
HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
|
|
CMD wget -qO- http://localhost:8081/healthz || exit 1
|
|
ENTRYPOINT ["dotnet", "ContactRelay.dll"]
|