cesnimda
9088dcffb9
- site image: multi-stage node build -> unprivileged nginx (non-root, read-only) - nginx: CSP + security headers, immutable asset caching, revalidated HTML, canonical trailing slash, preserved /Linkedin 301, legacy-WP 410s, custom 404 - externalise theme-init so CSP uses script-src 'self' (no inline hash) - prod + dev compose; .env.example; relay Dockerfile fixed (image ships app user) - Gitea Actions: quality, e2e, lighthouse budgets, relay build, image push on main - verified: both images build; relay healthz 200; site serves EN/NO with CSP + redirect Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
19 lines
581 B
Docker
19 lines
581 B
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# ---- build ----
|
|
FROM node:22-alpine AS build
|
|
WORKDIR /app
|
|
RUN corepack enable
|
|
COPY package.json pnpm-lock.yaml ./
|
|
RUN pnpm install --frozen-lockfile
|
|
COPY . .
|
|
ENV ASTRO_TELEMETRY_DISABLED=1
|
|
RUN pnpm build
|
|
|
|
# ---- runtime: static files behind unprivileged nginx (non-root, read-only capable) ----
|
|
FROM nginxinc/nginx-unprivileged:1.27-alpine AS final
|
|
COPY --chown=nginx:nginx nginx.conf /etc/nginx/conf.d/default.conf
|
|
COPY --from=build --chown=nginx:nginx /app/dist /usr/share/nginx/html
|
|
EXPOSE 8080
|
|
# runs as uid 101 (nginx) by default in this image
|