TehRiehlDeal
ca3862d5a7
BREAKING CHANGE: the production container listens on 8080 instead of 80. nginx now runs as an unprivileged user and cannot bind a privileged port without CAP_NET_BIND_SERVICE, which compose drops. Anything routing to this container must be repointed - in the homelab Traefik config, traefik.http.services.movieloop.loadbalancer.server.port 80 -> 8080. nginx's add_header is not additive across levels: a block declaring any add_header of its own discards every header inherited from its parent. Both /assets/ and /config.js declared one, so X-Frame-Options, X-Content-Type-Options and Referrer-Policy were silently absent from every JavaScript and CSS response. The headers now come from a snippet included in each location - verified 6/6 on /, on a hashed asset bundle, and on /config.js. Adds a CSP, HSTS and Permissions-Policy. connect-src is derived at container start from API_URL, because the API is deliberately not same-origin in production; asserting same-origin would have broken the deployment outright. The inline theme script is allowed by SHA-256 hash rather than unsafe-inline, which would have bought almost nothing - editing that script means regenerating the hash. config.js is also no longer rendered with envsubst, which does no escaping: an API_URL containing a double quote closed the JS string literal and the remainder executed on every page load. Addresses M31, M34.
51 lines
2.0 KiB
Docker
51 lines
2.0 KiB
Docker
# --- Dev stage ---
|
|
FROM node:22-alpine AS dev
|
|
WORKDIR /app
|
|
COPY package*.json ./
|
|
RUN npm ci
|
|
COPY . .
|
|
EXPOSE 5173
|
|
# Invoke vite directly rather than through `npm run`: under `docker compose
|
|
# up -d` (no TTY, no stdin) the npm wrapper printed its banner and exited 0
|
|
# immediately, so the dev server never came up.
|
|
CMD ["node", "node_modules/vite/bin/vite.js", "--host"]
|
|
|
|
# --- Build stage ---
|
|
# No VITE_API_URL build arg: the production image uses runtime config (/config.js)
|
|
# rendered at container startup. See docker/40-render-config.sh.
|
|
FROM node:22-alpine AS build
|
|
WORKDIR /app
|
|
COPY package*.json ./
|
|
RUN npm ci
|
|
COPY . .
|
|
RUN npm run build
|
|
|
|
# --- Production stage ---
|
|
# nginx-unprivileged rather than nginx: the stock image runs its master process
|
|
# as root, which this container has no need for - it serves static files. It
|
|
# listens on 8080 because a non-root process cannot bind a privileged port
|
|
# without CAP_NET_BIND_SERVICE, and that capability is dropped in compose.
|
|
FROM nginxinc/nginx-unprivileged:alpine AS production
|
|
|
|
# Package upgrades and directory ownership need root; the image drops back to
|
|
# its unprivileged user before nginx starts.
|
|
USER root
|
|
# Pull current security fixes for OS packages inherited from the base image
|
|
# (e.g. nghttp2-libs CVE-2026-27135). envsubst is no longer installed:
|
|
# 40-render-config.sh writes config.js itself so it can escape the value, which
|
|
# envsubst cannot do.
|
|
RUN apk upgrade --no-cache
|
|
|
|
COPY --from=build /app/dist /usr/share/nginx/html
|
|
COPY nginx.conf /etc/nginx/conf.d/default.conf
|
|
COPY docker/40-render-config.sh /docker-entrypoint.d/40-render-config.sh
|
|
|
|
# The entrypoint script writes config.js and the security-header snippet at
|
|
# start-up, so both destinations must be writable by the unprivileged user.
|
|
# 101 is the nginx uid/gid in this image.
|
|
RUN chmod +x /docker-entrypoint.d/40-render-config.sh && mkdir -p /etc/nginx/snippets && chown -R 101:101 /usr/share/nginx/html /etc/nginx/snippets
|
|
|
|
USER 101
|
|
EXPOSE 8080
|
|
# The upstream entrypoint runs /docker-entrypoint.d/*.sh then launches nginx.
|