forked from mirror/crumbs-original
Claude
effe7e3e72
The image switched to the node user (uid 1000) at build time, so a host folder mounted at /data kept its host ownership and SQLite failed with SQLITE_CANTOPEN in a restart loop. Named and anonymous volumes worked only because Docker copies the image's /data ownership into them. The container now starts as root, hands DATA_DIR and the database folder to node (only entries not already owned by it), and execs the app via setpriv as node. Containers started with an explicit `user:` skip this. Adds a CI step that runs the image with a host-owned bind mount. Fixes #93 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016MHECwBhBpM248EFSBi4L5
60 lines
1.5 KiB
Docker
60 lines
1.5 KiB
Docker
# Stage 1: Build
|
|
FROM node:22-slim AS build
|
|
|
|
WORKDIR /app
|
|
RUN corepack enable && corepack prepare pnpm@9 --activate
|
|
|
|
# Copy package files
|
|
COPY package.json pnpm-lock.yaml ./
|
|
|
|
# Install dependencies (with native module builds)
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
# Copy source code
|
|
COPY . .
|
|
|
|
# Build the SvelteKit app
|
|
RUN pnpm run build
|
|
|
|
# Prune dev dependencies
|
|
RUN pnpm prune --prod
|
|
|
|
# Stage 2: Runtime
|
|
FROM node:22-slim AS runtime
|
|
|
|
WORKDIR /app
|
|
|
|
# Install only what's needed for native modules
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Copy built app and production dependencies
|
|
COPY --from=build /app/build ./build
|
|
COPY --from=build /app/node_modules ./node_modules
|
|
COPY --from=build /app/package.json ./
|
|
|
|
# Create data directory
|
|
RUN mkdir -p /data && chown -R node:node /data
|
|
|
|
# Runs as root only long enough to hand the data folder (often a host bind
|
|
# mount) to the node user, then drops privileges — see crumbs-entrypoint.sh
|
|
COPY crumbs-entrypoint.sh /usr/local/bin/crumbs-entrypoint.sh
|
|
ENTRYPOINT ["crumbs-entrypoint.sh"]
|
|
|
|
# Configuration
|
|
ENV NODE_ENV=production
|
|
ENV DATA_DIR=/data
|
|
ENV DATABASE_URL=/data/crumbs.db
|
|
ENV PORT=3000
|
|
ENV ORIGIN=http://localhost:3000
|
|
|
|
EXPOSE 3000
|
|
|
|
VOLUME ["/data"]
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
|
|
CMD node -e "fetch('http://localhost:3000/login').then(r => r.ok ? process.exit(0) : process.exit(1)).catch(() => process.exit(1))"
|
|
|
|
CMD ["node", "build"]
|