mirror of
https://github.com/tiennm99/goclaw.git
synced 2026-07-25 08:18:56 +00:00
viettranx
2a61365353
pnpm build under a restrictive umask produces 0600 files; when copied into nginx:alpine, the non-root nginx worker hits EACCES and serves 403 for every static asset. Force mode via COPY --chmod=0755 (Docker BuildKit applies uniformly — directories need the exec bit for traversal, static files don't care about the extra bit). Closes #761
32 lines
767 B
Docker
32 lines
767 B
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# ── Stage 1: Build ──
|
|
FROM node:22-alpine AS builder
|
|
|
|
RUN corepack enable && corepack prepare pnpm@10.28.2 --activate
|
|
|
|
WORKDIR /app
|
|
|
|
# Cache dependencies
|
|
COPY package.json pnpm-lock.yaml ./
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
# Copy source and build
|
|
COPY . .
|
|
RUN pnpm build
|
|
|
|
# ── Stage 2: Serve ──
|
|
FROM nginx:1.27-alpine
|
|
|
|
# Copy built assets — force 0755 so the nginx worker (non-root) can read them
|
|
# regardless of pnpm's build-time umask (see #761).
|
|
COPY --chmod=0755 --from=builder /app/dist /usr/share/nginx/html
|
|
|
|
# Copy nginx config
|
|
COPY nginx.conf /etc/nginx/conf.d/default.conf
|
|
|
|
EXPOSE 80
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
|
|
CMD wget -qO- http://127.0.0.1:80/ || exit 1
|