81 lines
3.0 KiB
Docker
81 lines
3.0 KiB
Docker
# ─────────────────────────────────────────────────────────────
|
|
# Étape 1 — Installation des dépendances
|
|
# ─────────────────────────────────────────────────────────────
|
|
FROM node:20-alpine AS deps
|
|
|
|
RUN apk update && apk upgrade --no-cache && apk add --no-cache libc6-compat
|
|
|
|
WORKDIR /app
|
|
|
|
COPY package.json package-lock.json* ./
|
|
|
|
# ci : installation déterministe depuis le lock-file
|
|
RUN npm ci
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Étape 2 — Build de l'application
|
|
# ─────────────────────────────────────────────────────────────
|
|
FROM node:20-alpine AS builder
|
|
|
|
RUN apk update && apk upgrade --no-cache && apk add --no-cache libc6-compat
|
|
|
|
WORKDIR /app
|
|
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY . .
|
|
|
|
# Variables publiques (NEXT_PUBLIC_*) nécessaires au build.
|
|
# Les secrets serveur (SERVICE_ROLE_KEY…) ne sont JAMAIS passés ici.
|
|
ARG NEXT_PUBLIC_SUPABASE_URL
|
|
ARG NEXT_PUBLIC_SUPABASE_ANON_KEY
|
|
|
|
ENV NEXT_PUBLIC_SUPABASE_URL=$NEXT_PUBLIC_SUPABASE_URL \
|
|
NEXT_PUBLIC_SUPABASE_ANON_KEY=$NEXT_PUBLIC_SUPABASE_ANON_KEY \
|
|
NEXT_TELEMETRY_DISABLED=1 \
|
|
NODE_ENV=production
|
|
|
|
RUN npm run build
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Étape 3 — Image de production minimale et durcie
|
|
# ─────────────────────────────────────────────────────────────
|
|
FROM node:20-alpine AS runner
|
|
|
|
RUN apk update && apk upgrade --no-cache
|
|
|
|
WORKDIR /app
|
|
|
|
# Utilisateur non-root dédié
|
|
RUN addgroup --system --gid 1001 nodejs && \
|
|
adduser --system --uid 1001 nextjs
|
|
|
|
# Fichiers publics (favicon, images statiques…)
|
|
COPY --from=builder /app/public ./public
|
|
|
|
# Serveur Next.js standalone (bundle minimal sans node_modules complets)
|
|
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
|
|
|
|
# Assets statiques compilés (_next/static)
|
|
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
|
|
|
|
USER nextjs
|
|
|
|
ENV NODE_ENV=production \
|
|
NEXT_TELEMETRY_DISABLED=1 \
|
|
PORT=3000 \
|
|
HOSTNAME="0.0.0.0"
|
|
|
|
# Les secrets injectés au runtime (jamais dans l'image) :
|
|
# SUPABASE_SERVICE_ROLE_KEY
|
|
# NEXT_PUBLIC_SUPABASE_URL (si non baked au build)
|
|
# NEXT_PUBLIC_SUPABASE_ANON_KEY (si non baked au build)
|
|
|
|
EXPOSE 3000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=20s --retries=3 \
|
|
CMD wget -qO- http://localhost:3000/ | grep -q "html" || exit 1
|
|
|
|
CMD ["node", "server.js"]
|