Jason Woltje
0637992723
- Bump next 16.2.2 -> 16.2.3 (GHSA-q4gf-8mx6-v5v3 RSC DoS) - pnpm overrides: minimatch>=10.2.3, picomatch>=4.0.4, tar>=7.5.11 (CVE-2026-27903/27904, 33671, 29786, 31802) - Dockerfile runner: apk upgrade --no-cache pulls patched openssl 3.5.6-r0 and zlib 1.3.2-r0 before installing wget (CVE-2026-28390, 22184) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
53 lines
1.8 KiB
Docker
53 lines
1.8 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
# =============================================================================
|
|
# jasonwoltje.com — Next.js 16 + Payload 3 production image
|
|
# Multi-stage, non-root, standalone Next output. Built by Kaniko in Woodpecker.
|
|
# =============================================================================
|
|
|
|
ARG NODE_VERSION=24-alpine
|
|
|
|
# ---- deps ----
|
|
FROM node:${NODE_VERSION} AS deps
|
|
RUN apk add --no-cache libc6-compat
|
|
WORKDIR /app
|
|
RUN corepack enable && corepack prepare pnpm@10.31.0 --activate
|
|
COPY package.json pnpm-lock.yaml* ./
|
|
RUN --mount=type=cache,target=/pnpm-store \
|
|
pnpm config set store-dir /pnpm-store && \
|
|
pnpm install --frozen-lockfile
|
|
|
|
# ---- build ----
|
|
FROM node:${NODE_VERSION} AS build
|
|
WORKDIR /app
|
|
RUN corepack enable && corepack prepare pnpm@10.31.0 --activate
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY . .
|
|
ARG NEXT_PUBLIC_BUILD_SHA=unknown
|
|
ARG NEXT_PUBLIC_BUILD_REV=unknown
|
|
ENV NEXT_PUBLIC_BUILD_SHA=${NEXT_PUBLIC_BUILD_SHA} \
|
|
NEXT_PUBLIC_BUILD_REV=${NEXT_PUBLIC_BUILD_REV} \
|
|
NEXT_TELEMETRY_DISABLED=1 \
|
|
NODE_ENV=production
|
|
RUN pnpm build
|
|
|
|
# ---- runner ----
|
|
FROM node:${NODE_VERSION} AS runner
|
|
WORKDIR /app
|
|
ENV NODE_ENV=production \
|
|
NEXT_TELEMETRY_DISABLED=1 \
|
|
PORT=3000 \
|
|
HOSTNAME=0.0.0.0
|
|
RUN addgroup -g 1001 -S nodejs && adduser -S -u 1001 -G nodejs nextjs
|
|
RUN apk upgrade --no-cache && \
|
|
apk add --no-cache wget && \
|
|
mkdir -p /app/media && \
|
|
chown -R nextjs:nodejs /app
|
|
COPY --from=build --chown=nextjs:nodejs /app/public ./public
|
|
COPY --from=build --chown=nextjs:nodejs /app/.next/standalone ./
|
|
COPY --from=build --chown=nextjs:nodejs /app/.next/static ./.next/static
|
|
USER nextjs
|
|
EXPOSE 3000
|
|
HEALTHCHECK --interval=30s --timeout=5s --retries=3 --start-period=45s \
|
|
CMD wget -qO- http://127.0.0.1:3000/api/health || exit 1
|
|
CMD ["node", "server.js"]
|