mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-18 21:16:47 +00:00
jubnl
1fb6d19f6f
Both were created lazily on the first upload, which needs write permission on the uploads mount point itself at request time. On hosts whose bind-mounted uploads dir is not writable by the runtime user, every feature writing into an already-existing subdir keeps working while journey photo and place image uploads fail with EACCES (#1762). Creating them in the image and at boot turns that into one loud startup failure instead of a stray 500 on upload. Also drop the recursive chown over all of /app from the final layer: it copied up every inode it touched and duplicated node_modules, dist and the client bundle into a 518 MB layer. The chown now rides the layer that installs node_modules, later copies carry --chown=node:node, and the last layer chowns only the paths it creates. Everything under /app stays node-owned; image size 2.36 GB -> 1.68 GB.
132 lines
7.6 KiB
Docker
132 lines
7.6 KiB
Docker
# ── Stage 0: gosu ────────────────────────────────────────────────────────────
|
|
# Rebuild gosu with a current Go toolchain so the runtime image ships no stale
|
|
# Go stdlib (Debian's apt gosu is built with an old Go that trips CVE scanners).
|
|
# The binary and its runtime behaviour are identical to the apt package.
|
|
FROM golang:1.25-alpine AS gosu-build
|
|
RUN CGO_ENABLED=0 GOBIN=/out go install github.com/tianon/gosu@latest
|
|
|
|
# ── Stage 1: shared ──────────────────────────────────────────────────────────
|
|
FROM node:24-alpine AS shared-builder
|
|
WORKDIR /app
|
|
COPY package.json package-lock.json ./
|
|
COPY shared/package.json ./shared/
|
|
RUN npm ci --workspace=shared
|
|
COPY shared/ ./shared/
|
|
RUN npm run build --workspace=shared
|
|
|
|
# ── Stage 2: client ──────────────────────────────────────────────────────────
|
|
FROM node:24-alpine AS client-builder
|
|
WORKDIR /app
|
|
COPY package.json package-lock.json ./
|
|
COPY shared/package.json ./shared/
|
|
COPY client/package.json ./client/
|
|
RUN npm ci --workspace=client
|
|
COPY --from=shared-builder /app/shared/dist ./shared/dist
|
|
COPY client/ ./client/
|
|
RUN npm run build --workspace=client
|
|
|
|
# ── Stage 3: server ──────────────────────────────────────────────────────────
|
|
# --ignore-scripts skips native builds (better-sqlite3); they happen in the production stage.
|
|
FROM node:24-alpine AS server-builder
|
|
WORKDIR /app
|
|
COPY package.json package-lock.json ./
|
|
COPY shared/package.json ./shared/
|
|
COPY nest-mcp/package.json ./nest-mcp/
|
|
COPY server/package.json ./server/
|
|
RUN npm ci --workspace=server --ignore-scripts
|
|
COPY --from=shared-builder /app/shared/dist ./shared/dist
|
|
COPY nest-mcp/ ./nest-mcp/
|
|
RUN npm run build --workspace=nest-mcp
|
|
COPY server/ ./server/
|
|
RUN npm run build --workspace=server
|
|
|
|
# ── Stage 4: production runtime ──────────────────────────────────────────────
|
|
FROM node:24-trixie-slim
|
|
WORKDIR /app
|
|
|
|
# Workspace manifests only — source never enters this stage.
|
|
COPY package.json package-lock.json ./
|
|
COPY shared/package.json ./shared/
|
|
COPY nest-mcp/package.json ./nest-mcp/
|
|
COPY server/package.json ./server/
|
|
|
|
# The trailing chown runs in this layer on purpose: it covers the manifests and
|
|
# the freshly installed node_modules while they are already part of this layer's
|
|
# changeset, so it costs nothing. Everything copied after this point carries
|
|
# --chown=node:node for the same reason — a recursive chown in a later layer
|
|
# would copy up every inode it touches and duplicate the whole tree in the image.
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends tzdata dumb-init wget ca-certificates python3 build-essential \
|
|
libkitinerary-bin && \
|
|
npm ci --workspace=server --omit=dev && \
|
|
ln -sf "$(find /usr/lib -name kitinerary-extractor -type f | head -1)" /usr/local/bin/kitinerary-extractor; \
|
|
apt-get purge -y python3 build-essential && \
|
|
apt-get autoremove -y && \
|
|
rm -rf /var/lib/apt/lists/* /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx && \
|
|
chown -R node:node /app
|
|
|
|
# gosu rebuilt with a current Go toolchain (stage 0) — used by CMD to drop to node.
|
|
COPY --from=gosu-build /out/gosu /usr/local/bin/gosu
|
|
|
|
ENV XDG_CACHE_HOME=/tmp/kf6-cache
|
|
# Prevent Qt from probing for a display in headless containers.
|
|
ENV QT_QPA_PLATFORM=offscreen
|
|
# Fixed path for both amd64 (static binary) and arm64 (symlink to apt binary).
|
|
# Override with KITINERARY_EXTRACTOR_PATH if you install it elsewhere.
|
|
ENV KITINERARY_EXTRACTOR_PATH=/usr/local/bin/kitinerary-extractor
|
|
|
|
COPY --chown=node:node --from=server-builder /app/server/dist ./server/dist
|
|
# Runtime data assets read from server/assets at runtime: airports.json (flight
|
|
# transport search) and atlas/*.geojson.gz (Atlas country/region map). The build
|
|
# only emits dist, so these must be copied explicitly or the features silently
|
|
# degrade to empty in the image.
|
|
COPY --chown=node:node --from=server-builder /app/server/assets ./server/assets
|
|
# The in-app help pages (/help) read this straight from disk at runtime, so the
|
|
# docs always match the version running. Without it, wikiService falls back to
|
|
# fetching the GitHub wiki, which tracks main and needs network access.
|
|
COPY --chown=node:node wiki ./wiki
|
|
# tsconfig-paths/register reads this at runtime to resolve MCP SDK paths.
|
|
COPY --chown=node:node server/tsconfig.json ./server/
|
|
# Encryption-key rotation is run on demand via tsx (a prod dep) straight from the
|
|
# raw .ts source — it never enters dist, so it must be copied in explicitly or
|
|
# `node --import tsx scripts/migrate-encryption.ts` fails with module-not-found.
|
|
COPY --chown=node:node server/scripts/migrate-encryption.ts ./server/scripts/migrate-encryption.ts
|
|
# Admin recovery script (node server/reset-admin.js) for locked-out installs.
|
|
COPY --chown=node:node server/reset-admin.js ./server/reset-admin.js
|
|
COPY --chown=node:node --from=shared-builder /app/shared/dist ./shared/dist
|
|
# server dist requires @trek/nest-mcp at runtime through the workspace symlink;
|
|
# its dist's MCP SDK subpath requires ride the same tsconfig-paths/register
|
|
# hook the server already boots with.
|
|
COPY --chown=node:node --from=server-builder /app/nest-mcp/dist ./nest-mcp/dist
|
|
COPY --chown=node:node --from=client-builder /app/client/dist ./server/public
|
|
COPY --chown=node:node --from=client-builder /app/client/public/fonts ./server/public/fonts
|
|
|
|
# journey/ and places/ must be listed here and in server/src/index.ts (#1762) —
|
|
# a dir created lazily on first upload needs write permission on the uploads
|
|
# mount point itself, which fails with EACCES when the bind-mounted host dir
|
|
# isn't writable by node. Only paths this layer creates are chowned; anything
|
|
# already in the image arrived node-owned via --chown above.
|
|
RUN mkdir -p /app/data/logs /app/uploads/files /app/uploads/covers /app/uploads/avatars \
|
|
/app/uploads/photos /app/uploads/journey /app/uploads/places && \
|
|
ln -s /app/uploads /app/server/uploads && \
|
|
ln -s /app/data /app/server/data && \
|
|
chown -R node:node /app/data /app/uploads && \
|
|
chown -h node:node /app/server/uploads /app/server/data
|
|
|
|
ENV NODE_ENV=production
|
|
ENV PORT=3000
|
|
ARG APP_VERSION=dev
|
|
ENV APP_VERSION=${APP_VERSION}
|
|
|
|
EXPOSE 3000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
|
|
CMD wget -qO- http://localhost:3000/api/health || exit 1
|
|
|
|
ENTRYPOINT ["dumb-init", "--"]
|
|
# Preflight: if the app code is missing, a volume was almost certainly mounted
|
|
# over /app (it hides the image's node_modules + dist). Fail with actionable
|
|
# guidance instead of a cryptic "Cannot find module 'tsconfig-paths/register'".
|
|
# cd into server/ so tsconfig-paths/register finds tsconfig.json and ../node_modules resolves correctly.
|
|
CMD ["sh", "-c", "if [ ! -f /app/server/dist/index.js ] || [ ! -d /app/node_modules/tsconfig-paths ]; then echo 'FATAL: TREK application files are missing from the image.'; echo 'A volume is likely mounted over /app, which hides the app code.'; echo 'Mount ONLY your data and uploads dirs: -v ./data:/app/data -v ./uploads:/app/uploads'; echo 'Do NOT mount a volume at /app. See the Troubleshooting section of the README.'; exit 1; fi; chown -R node:node /app/data /app/uploads 2>/dev/null || true; cd /app/server && exec gosu node node --require tsconfig-paths/register dist/index.js"]
|