tiennm99/ccs
1
0
Fork 0
mirror of https://github.com/tiennm99/ccs.git synced 2026-07-16 12:15:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(docker): pin runtime deps to committed bun lockfile (#1358)

Browse Source
This commit is contained in:
Kai (Tam Nhu) Tran
2026-05-23 21:19:31 -04:00
committed by GitHub
parent 1e834b8478
commit aef331d8ef
1 changed files with 8 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/Dockerfile
+8 -15
View File
@@ -1,4 +1,4 @@
# syntax=docker/dockerfile:1 # syntax=docker/dockerfile:1.7
# ============================================================================= # =============================================================================
# Build stage: compile TypeScript and build UI # Build stage: compile TypeScript and build UI
@@ -36,13 +36,10 @@ RUN bun run build:all
# Validate build artifacts exist # Validate build artifacts exist
RUN test -d dist && test -d lib && echo "[OK] Build artifacts validated" RUN test -d dist && test -d lib && echo "[OK] Build artifacts validated"
# Generate a fresh npm lockfile from package.json immediately after build. # Build runtime deps from the committed bun.lock to keep Docker installs pinned.
# This lockfile is ephemeral — never committed; bun.lock remains the dev lockfile. # --ignore-scripts avoids user-home side effects from postinstall during image build.
# --ignore-scripts: only lockfile generation, no install side-effects needed here. RUN --mount=type=cache,target=/root/.bun \
# postinstall (scripts/postinstall.js) is a user-facing setup script; it must NOT bun install --frozen-lockfile --production --ignore-scripts
# run during the Docker build (it writes to ~/.ccs/ which does not exist here).
RUN --mount=type=cache,target=/root/.npm \
npm install --package-lock-only --ignore-scripts
# ============================================================================= # =============================================================================
# Runtime stage: Node-only, no Bun # Runtime stage: Node-only, no Bun
@@ -60,13 +57,9 @@ RUN apt-get update \
WORKDIR /app WORKDIR /app
# Copy the ephemeral lockfile generated in the build stage (never committed). # Copy pinned production dependencies resolved from the committed bun.lock.
# --ignore-scripts: postinstall writes ~/.ccs/ config which is not needed inside COPY --from=build /app/package.json ./
# the Docker image; runtime deps (bcrypt v6+, express, etc.) have no native COPY --from=build /app/node_modules ./node_modules
# compilation steps requiring postinstall.
COPY --from=build /app/package.json /app/package-lock.json ./
RUN --mount=type=cache,target=/root/.npm \
npm ci --omit=dev --ignore-scripts
COPY docker/entrypoint.sh /usr/local/bin/ccs-entrypoint COPY docker/entrypoint.sh /usr/local/bin/ccs-entrypoint
RUN chmod +x /usr/local/bin/ccs-entrypoint RUN chmod +x /usr/local/bin/ccs-entrypoint