mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbach
f45df04bf1
A defaulted build argument answers a question the caller failed to answer. The build then succeeds against a base image, version or path nobody chose, and the mistake surfaces as wrong behaviour at runtime instead of a failed build. web-app-bridgy-fed shows the cost: its metadata declared python 3.14 while the Dockerfile default silently built against 3.12. Both look plausible, so nothing pointed at the drift. It and web-app-postmarks now take the base image from the same services declaration the rest of the role reads. The lint walks every tracked Dockerfile, template variants and paths outside roles/ included, which the existing ARG-scope check does not. A second assertion fails when the scan finds no Dockerfile at all, so the rule cannot pass vacuously if the walk ever breaks. Touching the two Dockerfiles brought their pre-existing narration under the comment lint; what carried substance moved into the file header.
40 lines
1.1 KiB
Docker
40 lines
1.1 KiB
Docker
# Runtime image for Postmarks (Node.js bookmarking app), built from a clone of
|
|
# upstream.
|
|
#
|
|
# The build stage patches in a trusted-header SSO bridge, gated at runtime on
|
|
# PROXY_HEADER_SSO, and the final stage carries the whole application directory
|
|
# over so no packages are refetched at start.
|
|
ARG NODE_BASE
|
|
FROM ${NODE_BASE} AS build
|
|
|
|
ARG POSTMARKS_REPO_URL
|
|
ARG POSTMARKS_REF
|
|
|
|
RUN rm -rf /var/lib/apt/lists/* && \
|
|
apt-get -o Acquire::Retries=3 update && apt-get -o Acquire::Retries=3 install -y --no-install-recommends \
|
|
git ca-certificates && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /app
|
|
RUN git clone --depth=1 --branch "${POSTMARKS_REF}" "${POSTMARKS_REPO_URL}" ./
|
|
RUN npm install --no-fund --no-audit --omit=dev
|
|
|
|
COPY header_auth.js /app/src/sso-header-auth.js
|
|
COPY patch_server.js /app/sso-patch-server.js
|
|
RUN node /app/sso-patch-server.js /app/server.js && rm -f /app/sso-patch-server.js
|
|
|
|
FROM ${NODE_BASE}
|
|
|
|
ARG CONTAINER_PORT
|
|
ENV PORT=${CONTAINER_PORT}
|
|
ENV NODE_ENV=production
|
|
|
|
WORKDIR /app
|
|
COPY --from=build /app /app
|
|
|
|
RUN useradd -r -m -d /nonroot appuser && chown -R appuser:appuser /app
|
|
USER appuser
|
|
|
|
EXPOSE ${PORT}
|
|
CMD ["node", "server.js"]
|