clinical-submission/Dockerfile at main · Pan-Canadian-Genome-Library/clinical-submission · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
# Global variables
ARG COMMIT=""
ARG APP_USER=clinical
ARG WORKDIR=/clinical-submission

######################
# Configure base image
######################
FROM node:20.12.2-alpine AS base

ARG APP_USER
ARG WORKDIR

# Check https://github.com/nodejs/docker-node/tree/b4117f9333da4138b03a546ec926ef50a31506c3#nodealpine to understand why libc6-compat might be needed.
RUN apk add --no-cache libc6-compat

# install pnpm as root user, before updating node ownership
RUN npm i -g pnpm

# create our own user to run node, don't run node in production as root
ENV APP_UID=9999
ENV APP_GID=9999
RUN addgroup -S -g $APP_GID $APP_USER \
	&& adduser -S -u $APP_UID -g $APP_GID $APP_USER \
	&& mkdir -p ${WORKDIR}

WORKDIR ${WORKDIR}

RUN chown -R ${APP_USER}:${APP_USER} ${WORKDIR}

USER ${APP_USER}:${APP_USER}

######################
# Configure build image
######################

FROM base AS build

ARG APP_USER
ARG WORKDIR

COPY --chown=${APP_USER}:${APP_USER} . ./

RUN pnpm install --ignore-scripts
RUN pnpm build

######################
# Configure prod-deps image
######################

FROM build AS prod-deps

ARG APP_USER
ARG WORKDIR

WORKDIR ${WORKDIR}

USER ${APP_USER}:${APP_USER}

ENV CI=true
# pnpm will not install any package listed in devDependencies
RUN pnpm install --prod

######################
# Configure server image
######################
FROM base AS clinical-submission

ARG APP_USER
ARG WORKDIR
ARG SUBMISSION_DIR=${WORKDIR}/apps/submission

USER ${APP_USER}

COPY --from=build ${WORKDIR}/node_modules ./node_modules

WORKDIR ${SUBMISSION_DIR}

COPY --from=prod-deps ${SUBMISSION_DIR}/node_modules ./node_modules
COPY --from=build ${SUBMISSION_DIR}/dist .

EXPOSE 3030

ENV COMMIT_SHA=${COMMIT}
ENV NODE_ENV=production

CMD [ "pnpm", "start:prod" ]

#######################################################
# UI Server
#######################################################

FROM nginx:1.27-alpine-slim AS data-dictionary-ui

ARG APP_USER
ARG WORKDIR
ARG DATA_DICTIONARY_UI_DIR=${WORKDIR}/apps/data-dictionary-ui

# Create non-root user
ENV APP_UID=9999
ENV APP_GID=9999
RUN addgroup -S -g $APP_GID ${APP_USER} \
	&& adduser -S -u $APP_UID -g $APP_GID ${APP_USER}

# Modify permissions on nginx for our new user
RUN	chown -R ${APP_USER}:${APP_USER} /var/cache/nginx && \
	chown -R ${APP_USER}:${APP_USER} /etc/nginx/ && \
	chmod -R 755 /etc/nginx/ && \
	chown -R ${APP_USER}:${APP_USER} /var/log/nginx

RUN mkdir -p /etc/nginx/ssl/ && \
	chown -R ${APP_USER}:${APP_USER} /etc/nginx/ssl/ && \
	chmod -R 755 /etc/nginx/ssl/

RUN touch /var/run/nginx.pid && \
	chown -R ${APP_USER}:${APP_USER} /var/run/nginx.pid /run/nginx.pid

RUN	chown -R ${APP_USER}:${APP_USER} /docker-entrypoint.d && \
    chown -R ${APP_USER}:${APP_USER} /usr/share/nginx/html

# Switch to new user
USER ${APP_USER}

# Copy the runtime environmental variable replacement script
COPY --from=build ${DATA_DICTIONARY_UI_DIR}/docker/replace-env-script.sh /docker-entrypoint.d/replace-env-script.sh
RUN chmod +x /docker-entrypoint.d/replace-env-script.sh

# Copy site and nginx config
COPY --from=build ${DATA_DICTIONARY_UI_DIR}/dist /usr/share/nginx/html
COPY --from=build ${DATA_DICTIONARY_UI_DIR}/docker/nginx.conf.template /etc/nginx/templates/nginx.conf.template
RUN rm -f /etc/nginx/conf.d/default.conf

ENTRYPOINT ["/docker-entrypoint.sh"]
EXPOSE 3001
CMD ["nginx", "-g", "daemon off;"]