yml
925e2c0eaa
- Split into builder (node:22-bookworm) and runtime (node:22-bookworm-slim) - Remove VNC/X11 packages (xauth, x11vnc, novnc, websockify) from production - Install only minimal Chromium runtime libs in slim stage - Use python3 -m venv instead of --break-system-packages - npm prune --omit=dev to exclude devDependencies from runtime - Run as non-root user appuser (uid=1001) - Use HTTP apt mirrors (OrbStack BuildKit TLS workaround) - Copy only runtime-needed dirs: src/, config/, node_modules, venv, subservices - Expected image size: ~800MB-1.2GB (down from ~3.5GB)
119 lines
5.0 KiB
Docker
119 lines
5.0 KiB
Docker
# ============================================================================
|
||
# Production Backend Dockerfile — Multi-stage Build
|
||
# Optimized from ~3.5GB down to ~800MB–1.2GB
|
||
# ============================================================================
|
||
# Stage 1 (builder): Full node:22-bookworm — install everything needed for building
|
||
# Stage 2 (runtime): node:22-bookworm-slim — minimal runtime only
|
||
# ============================================================================
|
||
|
||
# --------------------------- Builder Stage -----------------------------------
|
||
FROM node:22-bookworm AS builder
|
||
|
||
ARG DEBIAN_MIRROR=mirrors.cloud.tencent.com
|
||
ARG NPM_REGISTRY=https://registry.npmmirror.com
|
||
ARG UV_INDEX_URL=https://mirrors.cloud.tencent.com/pypi/simple
|
||
|
||
# NOTE: Use HTTP (not HTTPS) for apt mirrors — OrbStack BuildKit cannot verify
|
||
# TLS certs during build. Apt packages are GPG-signed so HTTP is safe.
|
||
ENV DEBIAN_FRONTEND=noninteractive
|
||
ENV PIP_INDEX_URL=${UV_INDEX_URL}
|
||
ENV NPM_CONFIG_REGISTRY=${NPM_REGISTRY}
|
||
|
||
WORKDIR /app
|
||
|
||
# --- System packages for building ---
|
||
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
|
||
--mount=type=cache,target=/var/lib/apt,sharing=locked \
|
||
sed -i "s|http://deb.debian.org/debian|http://${DEBIAN_MIRROR}/debian|g" /etc/apt/sources.list.d/debian.sources \
|
||
&& sed -i "s|http://security.debian.org/debian-security|http://${DEBIAN_MIRROR}/debian-security|g" /etc/apt/sources.list.d/debian.sources \
|
||
&& apt-get update \
|
||
&& apt-get install -y --no-install-recommends \
|
||
python3 python3-pip python3-venv curl ca-certificates tzdata
|
||
|
||
# --- Node dependencies (full, including devDeps for postinstall scripts) ---
|
||
COPY apps/backend/package.json apps/backend/package-lock.json ./
|
||
RUN --mount=type=cache,target=/root/.npm \
|
||
npm ci
|
||
|
||
# --- Prune devDependencies after install ---
|
||
RUN npm prune --omit=dev
|
||
|
||
# --- Playwright — install Chromium with system deps (builder has full apt) ---
|
||
ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright
|
||
RUN --mount=type=cache,target=/ms-playwright-cache,sharing=locked \
|
||
PLAYWRIGHT_BROWSERS_PATH=/ms-playwright-cache \
|
||
PLAYWRIGHT_DOWNLOAD_HOST=https://npmmirror.com/mirrors/playwright/ \
|
||
npx playwright install --with-deps chromium \
|
||
&& cp -r /ms-playwright-cache /ms-playwright
|
||
|
||
# --- Python venv for OCR worker ---
|
||
# Use a virtual environment instead of --break-system-packages
|
||
COPY apps/backend/subservices/ocr-worker/ ./subservices/ocr-worker/
|
||
RUN python3 -m venv /app/venv \
|
||
&& /app/venv/bin/pip install --no-cache-dir -U pip \
|
||
&& /app/venv/bin/pip install --no-cache-dir ./subservices/ocr-worker
|
||
|
||
# --- Copy application source ---
|
||
COPY apps/backend/ ./
|
||
|
||
# --------------------------- Runtime Stage -----------------------------------
|
||
FROM node:22-bookworm-slim AS runtime
|
||
|
||
ARG DEBIAN_MIRROR=mirrors.cloud.tencent.com
|
||
|
||
# HTTP mirrors — see builder note about OrbStack TLS
|
||
ENV DEBIAN_FRONTEND=noninteractive
|
||
ENV TZ=Asia/Shanghai
|
||
ENV NODE_ENV=production
|
||
ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright
|
||
ENV OCR_PROJECT_ROOT=/app/subservices/ocr-worker
|
||
|
||
WORKDIR /app
|
||
|
||
# --- Minimal runtime apt packages ---
|
||
# - curl: health check (docker-compose uses `curl -fsS http://127.0.0.1:3000/health/ready`)
|
||
# - ca-certificates: TLS for outbound HTTPS calls
|
||
# - python3: needed by venv (links to system libpython)
|
||
# - tzdata: timezone data for TZ=Asia/Shanghai
|
||
# - Chromium runtime libs: minimal set for headless Chromium on slim
|
||
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
|
||
--mount=type=cache,target=/var/lib/apt,sharing=locked \
|
||
sed -i "s|http://deb.debian.org/debian|http://${DEBIAN_MIRROR}/debian|g" /etc/apt/sources.list.d/debian.sources \
|
||
&& sed -i "s|http://security.debian.org/debian-security|http://${DEBIAN_MIRROR}/debian-security|g" /etc/apt/sources.list.d/debian.sources \
|
||
&& apt-get update \
|
||
&& apt-get install -y --no-install-recommends \
|
||
curl ca-certificates python3 tzdata \
|
||
libnss3 libnspr4 libdbus-1-3 libatk1.0-0 libatk-bridge2.0-0 \
|
||
libcups2 libdrm2 libxkbcommon0 libatspi2.0-0 libxcomposite1 \
|
||
libxdamage1 libxfixes3 libxrandr2 libgbm1 libpango-1.0-0 \
|
||
libcairo2 libasound2 \
|
||
&& ln -snf /usr/share/zoneinfo/${TZ} /etc/localtime \
|
||
&& echo ${TZ} > /etc/timezone \
|
||
&& apt-get clean \
|
||
&& rm -rf /var/lib/apt/lists/*
|
||
|
||
# --- Copy artefacts from builder ---
|
||
# Pruned node_modules (no devDeps)
|
||
COPY --from=builder /app/node_modules ./node_modules
|
||
# Application source (no build step — runs directly via `node src/index.js`)
|
||
COPY --from=builder /app/package.json ./package.json
|
||
COPY --from=builder /app/src ./src
|
||
COPY --from=builder /app/config ./config
|
||
# Playwright browsers
|
||
COPY --from=builder /ms-playwright /ms-playwright
|
||
# Python venv for OCR worker
|
||
COPY --from=builder /app/venv ./venv
|
||
COPY --from=builder /app/subservices ./subservices
|
||
|
||
# --- Non-root user for security ---
|
||
RUN groupadd -g 1001 appuser \
|
||
&& useradd -m -u 1001 -g appuser appuser \
|
||
&& mkdir -p /app/data /app/data/browser-sessions /app/data/redeem-screenshots \
|
||
&& chown -R appuser:appuser /app/data /ms-playwright
|
||
|
||
USER appuser
|
||
|
||
EXPOSE 3000
|
||
|
||
CMD ["npm", "run", "start"]
|