Thomas Camlong
a84390818a
The pnpm-fetch layer added in #6296 broke the release build: pnpm 11.10.0 applies patchedDependencies during `pnpm fetch`, before node_modules exists, crashing with ENOENT. Install directly from the full context with the store cache mounted instead. Also audit and consolidate the workflows: - standardize action majors (cache@v6, upload-artifact@v7, github-script@v9) - provision Node from mise.toml via jdx/mise-action; drop .nvmrc - rename deployment-docker-image.yml -> deployment-release.yml, reuse the shared setup action, and scope GITHUB_TOKEN permissions per job - extract the duplicated beta/weekly release logic into a reusable deployment-release-pr.yml called by thin triggers
80 lines
2.9 KiB
Docker
80 lines
2.9 KiB
Docker
# syntax=docker/dockerfile:1.25
|
|
|
|
FROM node:24.18.0-alpine AS base
|
|
|
|
FROM base AS builder
|
|
WORKDIR /app
|
|
RUN apk add --no-cache libc6-compat curl bash && apk update
|
|
|
|
RUN corepack enable pnpm
|
|
|
|
# NOTE: We intentionally do NOT use `pnpm fetch` here. pnpm 11.10.0 applies
|
|
# `patchedDependencies` patches during the fetch phase, before packages are
|
|
# unpacked into node_modules, which crashes with ENOENT (chdir into a
|
|
# not-yet-existing node_modules path). Installing directly from the full
|
|
# context with the store cache mounted keeps builds fast without that break.
|
|
COPY . .
|
|
RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
|
|
pnpm config set store-dir /pnpm/store && \
|
|
pnpm install --recursive --frozen-lockfile
|
|
|
|
ARG SKIP_ENV_VALIDATION='true'
|
|
ARG CI='true'
|
|
ARG DISABLE_REDIS_LOGS='true'
|
|
ARG TARGETPLATFORM
|
|
|
|
RUN --mount=type=secret,id=TURBO_API,env=TURBO_API \
|
|
--mount=type=secret,id=TURBO_TEAM,env=TURBO_TEAM \
|
|
--mount=type=secret,id=TURBO_TOKEN,env=TURBO_TOKEN \
|
|
--mount=type=secret,id=TURBO_REMOTE_CACHE_SIGNATURE_KEY,env=TURBO_REMOTE_CACHE_SIGNATURE_KEY \
|
|
TURBO_PLATFORM="${TARGETPLATFORM:-linux/amd64}" pnpm build
|
|
|
|
FROM base AS runner
|
|
WORKDIR /app
|
|
|
|
# gettext is required for envsubst, openssl for generating AUTH_SECRET, su-exec for running application as non-root
|
|
RUN apk add --no-cache redis nginx bash gettext su-exec openssl
|
|
RUN mkdir /appdata
|
|
VOLUME /appdata
|
|
|
|
# Enable homarr cli
|
|
COPY --from=builder /app/packages/cli/cli.cjs /app/apps/cli/cli.cjs
|
|
RUN echo $'#!/bin/bash\ncd /app/apps/cli && node ./cli.cjs "$@"' > /usr/bin/homarr
|
|
RUN chmod +x /usr/bin/homarr
|
|
|
|
# Don't run production as root
|
|
RUN mkdir -p /var/cache/nginx && \
|
|
mkdir -p /var/log/nginx && \
|
|
mkdir -p /var/lib/nginx && \
|
|
touch /run/nginx/nginx.pid && \
|
|
mkdir -p /etc/nginx/templates /etc/nginx/ssl/certs
|
|
|
|
COPY --from=builder /app/apps/nextjs/next.config.ts .
|
|
COPY --from=builder /app/apps/nextjs/package.json .
|
|
COPY --from=builder /app/pnpm-workspace.yaml ./pnpm-workspace.yaml
|
|
|
|
COPY --from=builder /app/node_modules/better-sqlite3/build/Release/better_sqlite3.node /app/build/better_sqlite3.node
|
|
|
|
COPY --from=builder /app/packages/db/migrations ./db/migrations
|
|
|
|
# Automatically leverage output traces to reduce image size
|
|
# https://nextjs.org/docs/advanced-features/output-file-tracing
|
|
COPY --from=builder /app/apps/nextjs/.next/standalone ./
|
|
COPY --from=builder /app/apps/nextjs/.next/static ./apps/nextjs/.next/static
|
|
COPY --from=builder /app/apps/nextjs/public ./apps/nextjs/public
|
|
COPY scripts/run.sh ./run.sh
|
|
COPY --chmod=755 scripts/entrypoint.sh ./entrypoint.sh
|
|
COPY packages/redis/redis.conf /app/redis.conf
|
|
COPY nginx.conf /etc/nginx/templates/nginx.conf
|
|
|
|
|
|
ENV DB_URL='/appdata/db/db.sqlite'
|
|
ENV DB_DIALECT='sqlite'
|
|
ENV DB_DRIVER='better-sqlite3'
|
|
ENV AUTH_PROVIDERS='credentials'
|
|
ENV REDIS_IS_EXTERNAL='false'
|
|
ENV NODE_ENV='production'
|
|
|
|
ENTRYPOINT [ "/app/entrypoint.sh" ]
|
|
CMD ["sh", "run.sh"]
|