apps/ws/Dockerfile - next - githubmirror/novu

apps/ws/Dockerfile
78 строк3 KB
Himanshu Garg
chore(root): changes for release and bumping up node to a security release (#12250)
07 авг 2026, 11:06
07 авг 2026, 11:06db33feb
FROM node:22.23-alpine3.23 AS dev_base
RUN apk add --no-cache g++ make py3-pip
ENV NX_DAEMON=false

# Install global dependencies
RUN npm --no-update-notifier --no-fund --global install pm2@6.0.14 pnpm@11.0.9&& \
    pnpm --version

# Set non-root user
USER 1000
WORKDIR /usr/src/app

FROM dev_base AS dev
ARG PACKAGE_PATH

COPY --chown=1000:1000 ./meta .
COPY --chown=1000:1000 ./deps .
COPY --chown=1000:1000 ./pkg .

RUN --mount=type=secret,id=BULL_MQ_PRO_NPM_TOKEN,uid=1000 export BULL_MQ_PRO_NPM_TOKEN=$(cat /run/secrets/BULL_MQ_PRO_NPM_TOKEN) && \
    if [ -n "${BULL_MQ_PRO_NPM_TOKEN}" ] ; then echo 'Building with Enterprise Edition of Novu'; rm -f .npmrc ; cp .npmrc-cloud .npmrc ; fi

RUN --mount=type=cache,id=pnpm-store-ws,target=/root/.pnpm-store\
    --mount=type=secret,id=BULL_MQ_PRO_NPM_TOKEN,uid=1000 export BULL_MQ_PRO_NPM_TOKEN=$(cat /run/secrets/BULL_MQ_PRO_NPM_TOKEN) && \
 pnpm install --filter "novuhq" --filter "{${PACKAGE_PATH}}..."\
 --frozen-lockfile\
 --unsafe-perm\
 --reporter=silent

RUN --mount=type=secret,id=BULL_MQ_PRO_NPM_TOKEN,uid=1000 export BULL_MQ_PRO_NPM_TOKEN=$(cat /run/secrets/BULL_MQ_PRO_NPM_TOKEN) && NODE_ENV=production NX_DAEMON=false pnpm build:ws

WORKDIR /usr/src/app/apps/ws

RUN cp src/.example.env dist/.env
RUN cp src/.env.development dist/.env.development
RUN cp src/.env.production dist/.env.production
RUN rm -f dist/.env.test dist/.env.ci

WORKDIR /usr/src/app

# ------- DEPLOY ----------
FROM dev AS deploy

WORKDIR /usr/src/app
RUN --mount=type=secret,id=BULL_MQ_PRO_NPM_TOKEN,uid=1000 export BULL_MQ_PRO_NPM_TOKEN=$(cat /run/secrets/BULL_MQ_PRO_NPM_TOKEN) && \
    pnpm --filter @novu/ws deploy --legacy --prod /usr/src/deploy && \
    if [ -n "${BULL_MQ_PRO_NPM_TOKEN}" ]; then \
      cd $(mktemp -d) && \
      echo "@taskforcesh:registry=https://npm.taskforce.sh/" > .npmrc && \
      echo "//npm.taskforce.sh/:_authToken=${BULL_MQ_PRO_NPM_TOKEN}" >> .npmrc && \
      npm init -y > /dev/null 2>&1 && \
      npm install @taskforcesh/bullmq-pro@6.11.0 2>/dev/null && \
      cp -r node_modules/@taskforcesh /usr/src/deploy/node_modules/@taskforcesh && \
      rm -rf node_modules/@taskforcesh && \
      mv node_modules /usr/src/deploy/node_modules/@taskforcesh/bullmq-pro/node_modules; \
    fi

# ------- PRODUCTION BUILD ----------
FROM node:22.23-alpine3.23 AS prod

ENV CI=true

RUN apk upgrade --no-cache && \
    apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/edge/main --upgrade libcrypto3 libssl3 musl musl-utils && \
    npm --no-update-notifier --no-fund --global install pm2@6.0.14 && \
    rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx

# Set non-root user
USER 1000
WORKDIR /usr/src/app

# Flat node_modules from pnpm deploy (no symlinks, no hoisting issues)
COPY --chown=1000:1000 --from=deploy /usr/src/deploy .

# Built output (not included by pnpm deploy because dist is gitignored)
COPY --chown=1000:1000 --from=dev /usr/src/app/apps/ws/dist ./dist

ENTRYPOINT [ "sh", "-c", "pm2-runtime start dist/main.js -i max" ]