yml2213
e815001a54
默认 DEBIAN/ALPINE 源改为 mirrors.aliyun.com，compose 支持通过环境变量覆盖；构建时先装 ca-certificates，避免 slim 镜像换源后 HTTPS 校验失败。
71 lines
2.7 KiB
Docker
71 lines
2.7 KiB
Docker
# 快手轻量后端镜像
|
|
FROM docker.m.daocloud.io/library/node:22-bookworm AS builder
|
|
|
|
# 阿里云公共源（全国可达）；也可构建时覆盖：--build-arg DEBIAN_MIRROR=mirrors.cloud.aliyuncs.com
|
|
ARG DEBIAN_MIRROR=mirrors.aliyun.com
|
|
ARG NPM_REGISTRY=https://registry.npmmirror.com
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
ENV NPM_CONFIG_REGISTRY=${NPM_REGISTRY}
|
|
|
|
WORKDIR /app
|
|
|
|
# bookworm 基础镜像可能尚无 ca-certificates；国内源常跳 HTTPS，需先跳过校验装证书
|
|
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
|
|
--mount=type=cache,target=/var/lib/apt,sharing=locked \
|
|
sed -i "s|http://deb.debian.org/debian|http://${DEBIAN_MIRROR}/debian|g" /etc/apt/sources.list.d/debian.sources \
|
|
&& sed -i "s|http://security.debian.org/debian-security|http://${DEBIAN_MIRROR}/debian-security|g" /etc/apt/sources.list.d/debian.sources \
|
|
&& apt-get -o Acquire::https::Verify-Peer=false -o Acquire::https::Verify-Host=false update \
|
|
&& apt-get -o Acquire::https::Verify-Peer=false -o Acquire::https::Verify-Host=false install -y --no-install-recommends \
|
|
ca-certificates \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
curl tzdata
|
|
|
|
COPY apps/backend/package.json apps/backend/package-lock.json ./
|
|
RUN --mount=type=cache,target=/root/.npm npm ci
|
|
|
|
COPY apps/backend/ ./
|
|
RUN npm run build \
|
|
&& npm prune --omit=dev
|
|
|
|
FROM docker.m.daocloud.io/library/node:22-bookworm-slim AS runtime
|
|
|
|
ARG DEBIAN_MIRROR=mirrors.aliyun.com
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
ENV TZ=Asia/Shanghai
|
|
ENV NODE_ENV=production
|
|
|
|
WORKDIR /app
|
|
|
|
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
|
|
--mount=type=cache,target=/var/lib/apt,sharing=locked \
|
|
sed -i "s|http://deb.debian.org/debian|http://${DEBIAN_MIRROR}/debian|g" /etc/apt/sources.list.d/debian.sources \
|
|
&& sed -i "s|http://security.debian.org/debian-security|http://${DEBIAN_MIRROR}/debian-security|g" /etc/apt/sources.list.d/debian.sources \
|
|
&& apt-get -o Acquire::https::Verify-Peer=false -o Acquire::https::Verify-Host=false update \
|
|
&& apt-get -o Acquire::https::Verify-Peer=false -o Acquire::https::Verify-Host=false install -y --no-install-recommends \
|
|
ca-certificates \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
curl tzdata \
|
|
&& ln -snf /usr/share/zoneinfo/${TZ} /etc/localtime \
|
|
&& echo ${TZ} > /etc/timezone \
|
|
&& apt-get clean \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=builder /app/node_modules ./node_modules
|
|
COPY --from=builder /app/package.json ./package.json
|
|
COPY --from=builder /app/dist ./dist
|
|
|
|
RUN groupadd -g 1001 appuser \
|
|
&& useradd -m -u 1001 -g appuser appuser \
|
|
&& mkdir -p /app/data \
|
|
&& chown -R appuser:appuser /app/data
|
|
|
|
USER appuser
|
|
|
|
EXPOSE 3000
|
|
|
|
CMD ["npm", "run", "start"]
|