|
1 | | -FROM node:18.15.0-alpine as front |
2 | | -RUN apk update |
3 | | -RUN apk add --no-cache --virtual .gyp \ |
| 1 | +# this dockerfile has two stages, a build stage and the executable stage. |
| 2 | +# the build stage is responsible for building the frontend, the backend, |
| 3 | +# and the frontend's static assets. ideally, we could build the frontend and backend |
| 4 | +# independently and in parallel in different stages, but there is a dependency |
| 5 | +# on the backend to build those assets. until we fix that, this approach is |
| 6 | +# the best way to minimize the number of node_module restores and build steps |
| 7 | +# while still keeping the final image small. |
| 8 | + |
| 9 | +FROM node:18.18-alpine as build |
| 10 | + |
| 11 | +# update apk repository and install build dependencies |
| 12 | +RUN apk update && apk add --no-cache --virtual .gyp \ |
4 | 13 | python3 \ |
5 | 14 | make \ |
6 | 15 | g++ |
| 16 | + |
| 17 | +# set workdir |
7 | 18 | WORKDIR /usr/src/app |
| 19 | + |
| 20 | +# restore node_modules for front-end |
8 | 21 | COPY package.json yarn.lock babel.config.cjs tsconfig.json ./ |
9 | 22 | RUN SKIP_POSTINSTALL=1 yarn install |
| 23 | + |
| 24 | +# prepare backend by copying scripts/configs and installing node modules |
| 25 | +# this is required to build the static assets |
10 | 26 | COPY configs ./configs |
11 | 27 | COPY scripts ./scripts |
12 | 28 | COPY redisinsight ./redisinsight |
13 | | -RUN yarn --cwd redisinsight/api |
14 | | -ARG SERVER_TLS_CERT |
15 | | -ARG SERVER_TLS_KEY |
16 | | -ARG SEGMENT_WRITE_KEY |
17 | | -ENV SERVER_TLS_CERT=${SERVER_TLS_CERT} |
18 | | -ENV SERVER_TLS_KEY=${SERVER_TLS_KEY} |
19 | | -ENV SEGMENT_WRITE_KEY=${SEGMENT_WRITE_KEY} |
| 29 | +RUN yarn --cwd redisinsight/api install |
| 30 | + |
| 31 | +# build the frontend, static assets, and backend api |
20 | 32 | RUN yarn build:web |
21 | 33 | RUN yarn build:statics |
| 34 | +RUN yarn build:api |
22 | 35 |
|
23 | | -FROM node:18.15.0-alpine as back |
24 | | -WORKDIR /usr/src/app |
25 | | -COPY redisinsight/api/package.json redisinsight/api/yarn.lock ./ |
26 | | -RUN yarn install |
27 | | -COPY redisinsight/api ./ |
28 | | -COPY --from=front /usr/src/app/redisinsight/api/static ./static |
29 | | -COPY --from=front /usr/src/app/redisinsight/api/defaults ./defaults |
30 | | -RUN yarn run build:prod |
31 | | - |
32 | | -FROM node:18.15.0-slim |
33 | | -# Set up mDNS functionality, to play well with Redis Enterprise |
34 | | -# clusters on the network. |
35 | | -RUN set -ex \ |
36 | | - && DEPS="avahi-daemon libnss-mdns" \ |
37 | | - && apt-get update && apt-get install -y --no-install-recommends $DEPS \ |
38 | | - # Disable nss-mdns's two-label limit heuristic so that host names |
39 | | - # with multiple labels can be resolved. |
40 | | - # E.g. redis-12000.rediscluster.local, which has 3 labels. |
41 | | - # (https://github.com/lathiat/nss-mdns#etcmdnsallow) |
42 | | - && echo '*' > /etc/mdns.allow \ |
43 | | - # Configure NSSwitch to use the mdns4 plugin so mdns.allow is respected |
44 | | - && sed -i "s/hosts:.*/hosts: files mdns4 dns/g" /etc/nsswitch.conf \ |
45 | | - # We run a `avahi-daemon` without `dbus` so that we can start it as a |
46 | | - # non-root user. `dbus` requires root permissions to start. And |
47 | | - # anyway, there's a way to run `avahi-daemon` without `dbus` so why |
48 | | - # shouldn't we use it. https://linux.die.net/man/5/avahi-daemon.conf |
49 | | - && printf "[server]\nenable-dbus=no\n" >> /etc/avahi/avahi-daemon.conf \ |
50 | | - && chmod 777 /etc/avahi/avahi-daemon.conf \ |
51 | | - # We create the directory because when the first time `avahi-daemon` |
52 | | - # is run, the directory doesn't exist and the `avahi-daemon` must have |
53 | | - # permissions to create the directory under `/var`. |
54 | | - && mkdir -p /var/run/avahi-daemon \ |
55 | | - # Change the permissions of the directories avahi will use. |
56 | | - && chown avahi:avahi /var/run/avahi-daemon \ |
57 | | - && chmod 777 /var/run/avahi-daemon |
58 | | - |
59 | | -RUN apt-get install net-tools |
60 | | -RUN apt-get install -y dbus-x11 gnome-keyring libsecret-1-0 |
61 | | -RUN dbus-uuidgen > /var/lib/dbus/machine-id |
| 36 | +# install backend _again_ to build native modules and remove dev dependencies, |
| 37 | +# then run autoclean to remove additional unnecessary files |
| 38 | +RUN yarn --cwd ./redisinsight/api install --production |
| 39 | +COPY ./redisinsight/api/.yarnclean.prod ./redisinsight/api/.yarnclean |
| 40 | +RUN yarn --cwd ./redisinsight/api autoclean --force |
| 41 | + |
| 42 | +FROM node:18.18-alpine |
62 | 43 |
|
| 44 | +# runtime args and environment variables |
63 | 45 | ARG NODE_ENV=production |
64 | | -ARG SERVER_TLS_CERT |
65 | | -ARG SERVER_TLS_KEY |
66 | | -ARG SEGMENT_WRITE_KEY |
67 | | -ENV SERVER_TLS_CERT=${SERVER_TLS_CERT} |
68 | | -ENV SERVER_TLS_KEY=${SERVER_TLS_KEY} |
69 | | -ENV SEGMENT_WRITE_KEY=${SEGMENT_WRITE_KEY} |
| 46 | +ARG RI_SEGMENT_WRITE_KEY |
| 47 | +ENV RI_SEGMENT_WRITE_KEY=${RI_SEGMENT_WRITE_KEY} |
70 | 48 | ENV NODE_ENV=${NODE_ENV} |
71 | | -ENV SERVER_STATIC_CONTENT=true |
72 | | -ENV BUILD_TYPE='DOCKER_ON_PREMISE' |
| 49 | +ENV RI_SERVE_STATICS=true |
| 50 | +ENV RI_BUILD_TYPE='DOCKER_ON_PREMISE' |
| 51 | +ENV RI_APP_FOLDER_ABSOLUTE_PATH='/data' |
| 52 | + |
| 53 | +# this resolves CVE-2023-5363 |
| 54 | +# TODO: remove this line once we update to base image that doesn't have this vulnerability |
| 55 | +RUN apk update && apk upgrade --no-cache libcrypto3 libssl3 |
| 56 | + |
| 57 | +# set workdir |
73 | 58 | WORKDIR /usr/src/app |
74 | | -COPY --from=back /usr/src/app/dist ./redisinsight/api/dist |
75 | | -COPY --from=front /usr/src/app/redisinsight/ui/dist ./redisinsight/ui/dist |
76 | 59 |
|
77 | | -# Build BE prod dependencies here to build native modules |
78 | | -COPY redisinsight/api/package.json redisinsight/api/yarn.lock ./redisinsight/api/ |
79 | | -RUN yarn --cwd ./redisinsight/api install --production |
80 | | -COPY redisinsight/api/.yarnclean.prod ./redisinsight/api/.yarnclean |
81 | | -RUN yarn --cwd ./redisinsight/api autoclean --force |
| 60 | +# copy artifacts built in previous stage to this one |
| 61 | +COPY --from=build --chown=node:node /usr/src/app/redisinsight/api/dist ./redisinsight/api/dist |
| 62 | +COPY --from=build --chown=node:node /usr/src/app/redisinsight/api/node_modules ./redisinsight/api/node_modules |
| 63 | +COPY --from=build --chown=node:node /usr/src/app/redisinsight/ui/dist ./redisinsight/ui/dist |
82 | 64 |
|
83 | | -COPY ./docker-entry.sh ./ |
| 65 | +# folder to store local database, plugins, logs and all other files |
| 66 | +RUN mkdir -p /data && chown -R node:node /data |
| 67 | + |
| 68 | +# copy the docker entry point script and make it executable |
| 69 | +COPY --chown=node:node ./docker-entry.sh ./ |
84 | 70 | RUN chmod +x docker-entry.sh |
85 | 71 |
|
| 72 | +# since RI is hard-code to port 5000, expose it from the container |
86 | 73 | EXPOSE 5000 |
87 | 74 |
|
| 75 | +# don't run the node process as root |
| 76 | +USER node |
| 77 | + |
| 78 | +# serve the application 🚀 |
88 | 79 | ENTRYPOINT ["./docker-entry.sh", "node", "redisinsight/api/dist/src/main"] |
0 commit comments