TehRiehlDeal
da32e49b0b
frontend-ci / lint (push) Successful in 24s
frontend-ci / test (push) Successful in 32s
frontend-ci / secrets-scan (push) Successful in 4s
frontend-ci / sast (push) Successful in 6s
frontend-ci / fs-scan (push) Successful in 11s
frontend-ci / typecheck (push) Successful in 14s
frontend-ci / build (push) Successful in 38s
frontend-ci / push (push) Skipped
frontend-ci / test (pull_request) Successful in 34s
frontend-ci / secrets-scan (pull_request) Successful in 4s
frontend-ci / sast (pull_request) Successful in 6s
frontend-ci / fs-scan (pull_request) Successful in 13s
frontend-ci / typecheck (pull_request) Successful in 23s
frontend-ci / lint (pull_request) Successful in 26s
frontend-ci / build (pull_request) Successful in 48s
frontend-ci / push (pull_request) Skipped
Enabling push in production failed with "Validation failed": the browser's PushSubscription.toJSON() carries expirationTime, and it was sent verbatim to a schema that is strict about unknown fields. The client now sends exactly endpoint + keys. The test doubles had been shaped like the schema rather than like a browser, which is why 1,112 tests said nothing. The CSP hash for index.html's inline theme script was hardcoded in the container's start-up script behind a comment asking for it to be regenerated by hand, and claiming a test asserted it; none did. The bytes are what the browser hashes, so an edit or a checkout with different line endings would have silently blocked the page's own script. The hash is now emitted by `npm run build` from the index.html that is actually shipped, copied into the image, and read at start; the container refuses to start without it. Verified against the built image: header hash equals served-script hash. For the record: a CSP console message in production is what led here, and the served page turned out to be correct - that message was a browser extension's injected script, which the policy is right to refuse.
55 lines
2.3 KiB
Docker
55 lines
2.3 KiB
Docker
# --- Dev stage ---
|
|
FROM node:22-alpine AS dev
|
|
WORKDIR /app
|
|
COPY package*.json ./
|
|
RUN npm ci
|
|
COPY . .
|
|
EXPOSE 5173
|
|
# Invoke vite directly rather than through `npm run`: under `docker compose
|
|
# up -d` (no TTY, no stdin) the npm wrapper printed its banner and exited 0
|
|
# immediately, so the dev server never came up.
|
|
CMD ["node", "node_modules/vite/bin/vite.js", "--host"]
|
|
|
|
# --- Build stage ---
|
|
# No VITE_API_URL build arg: the production image uses runtime config (/config.js)
|
|
# rendered at container startup. See docker/40-render-config.sh.
|
|
FROM node:22-alpine AS build
|
|
WORKDIR /app
|
|
COPY package*.json ./
|
|
RUN npm ci
|
|
COPY . .
|
|
RUN npm run build
|
|
|
|
# --- Production stage ---
|
|
# nginx-unprivileged rather than nginx: the stock image runs its master process
|
|
# as root, which this container has no need for - it serves static files. It
|
|
# listens on 8080 because a non-root process cannot bind a privileged port
|
|
# without CAP_NET_BIND_SERVICE, and that capability is dropped in compose.
|
|
FROM nginxinc/nginx-unprivileged:alpine AS production
|
|
|
|
# Package upgrades and directory ownership need root; the image drops back to
|
|
# its unprivileged user before nginx starts.
|
|
USER root
|
|
# Pull current security fixes for OS packages inherited from the base image
|
|
# (e.g. nghttp2-libs CVE-2026-27135). envsubst is no longer installed:
|
|
# 40-render-config.sh writes config.js itself so it can escape the value, which
|
|
# envsubst cannot do.
|
|
RUN apk upgrade --no-cache
|
|
|
|
COPY --from=build /app/dist /usr/share/nginx/html
|
|
# The CSP hash tokens for index.html's inline scripts, produced by `npm run
|
|
# build` from the shipped file. Outside the web root: it belongs to the
|
|
# server configuration, not the site.
|
|
COPY --from=build /app/build/csp-inline-script-hashes /etc/nginx/csp-inline-script-hashes
|
|
COPY nginx.conf /etc/nginx/conf.d/default.conf
|
|
COPY docker/40-render-config.sh /docker-entrypoint.d/40-render-config.sh
|
|
|
|
# The entrypoint script writes config.js and the security-header snippet at
|
|
# start-up, so both destinations must be writable by the unprivileged user.
|
|
# 101 is the nginx uid/gid in this image.
|
|
RUN chmod +x /docker-entrypoint.d/40-render-config.sh && mkdir -p /etc/nginx/snippets && chown -R 101:101 /usr/share/nginx/html /etc/nginx/snippets
|
|
|
|
USER 101
|
|
EXPOSE 8080
|
|
# The upstream entrypoint runs /docker-entrypoint.d/*.sh then launches nginx.
|