25 lines
1.1 KiB
Docker
25 lines
1.1 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# Static teaching site: build.sh runs the node assembler (pilot/assemble-arc.mjs) to
|
|
# produce dist/, then a pinned nginx-unprivileged serves it. No package installs - the
|
|
# assembler is dependency-free node.
|
|
|
|
# ---- build stage ----------------------------------------------------------
|
|
# A bookworm-slim node base, digest-pinned and typically served from the zot
|
|
# pull-through mirror; node runs the assembler.
|
|
FROM node:22-bookworm-slim@sha256:d9f850096136edbc402debdd8729579a288aac64574ada0ff4db26b6ae58b0b2 AS build
|
|
ARG BUILD_REV=dev
|
|
ENV BUILD_REV=$BUILD_REV
|
|
WORKDIR /app
|
|
COPY . .
|
|
RUN bash build.sh
|
|
|
|
# ---- runtime stage --------------------------------------------------------
|
|
# Same vetted digest as the site. Renovate keeps it current.
|
|
FROM ghcr.io/nginx/nginx-unprivileged:1.28.0-alpine@sha256:c97ff0bf7cbae369953c6da1232ec14ad9f971d66360c5698db0856a4cd657a0
|
|
|
|
COPY nginx/default.conf /etc/nginx/conf.d/default.conf
|
|
COPY nginx/security-headers.conf /etc/nginx/security-headers.conf
|
|
COPY --from=build /app/dist /usr/share/nginx/html
|
|
|
|
EXPOSE 8080
|