|
1 | 1 | # 阶段1:基础镜像准备
|
2 | 2 | FROM node:18-alpine AS base
|
3 | 3 |
|
4 |
| -ARG USE_CN_MIRROR |
5 |
| - |
6 | 4 | # 设置工作目录
|
7 | 5 | WORKDIR /app
|
8 | 6 |
|
9 |
| -# 配置国内镜像源(如果需要) |
10 |
| -RUN \ |
11 |
| - if [ "${USE_CN_MIRROR:-false}" = "true" ]; then \ |
12 |
| - npm config set registry https://registry.npmmirror.com/; \ |
13 |
| - fi |
| 7 | +# 配置国内镜像源 |
| 8 | +RUN npm config set registry https://registry.npmmirror.com/ |
14 | 9 |
|
15 |
| -# 安装必要的系统依赖(例如CA证书) |
| 10 | +# 安装必要的系统依赖(例如 CA 证书) |
16 | 11 | RUN apk add --no-cache ca-certificates
|
17 | 12 |
|
18 |
| -# 创建distroless目录,准备复制必要的运行时文件 |
19 |
| -RUN mkdir -p /distroless/bin /distroless/lib /distroless/etc/ssl/certs /distroless/etc |
20 |
| - |
21 |
| -# 复制Node.js可执行文件 |
22 |
| -RUN cp /usr/local/bin/node /distroless/bin/ |
23 |
| - |
24 |
| -# 复制Node.js运行时依赖的库文件 |
25 |
| -RUN ldd /usr/local/bin/node | awk '{print $3}' | grep -v '^$' | xargs -I '{}' cp '{}' /distroless/lib/ |
26 |
| - |
27 |
| -# 复制动态链接器 |
28 |
| -RUN cp /lib/ld-musl-$(uname -m).so.1 /distroless/lib/ |
29 |
| - |
30 |
| -# 复制CA证书 |
31 |
| -RUN cp -r /etc/ssl/certs /distroless/etc/ssl/ |
32 |
| - |
33 |
| -# 创建非root用户 |
34 |
| -RUN addgroup -g 1001 appgroup && \ |
35 |
| - adduser -D -u 1001 -G appgroup appuser |
36 |
| - |
37 |
| -# 复制用户和组信息 |
38 |
| -RUN cp /etc/passwd /distroless/etc/passwd && \ |
39 |
| - cp /etc/group /distroless/etc/group |
40 |
| - |
41 |
| - |
42 |
| - |
43 | 13 | # 阶段2:构建应用程序
|
44 | 14 | FROM base AS builder
|
45 | 15 |
|
46 |
| -ARG USE_CN_MIRROR |
47 |
| - |
48 | 16 | WORKDIR /app
|
49 | 17 |
|
50 | 18 | # 复制依赖文件
|
51 | 19 | COPY package.json yarn.lock ./
|
52 | 20 |
|
53 |
| -# 确保在构建阶段NODE_ENV不为production |
54 |
| -ENV NODE_ENV=development |
55 |
| - |
56 |
| -# 配置国内镜像源并安装依赖 |
57 |
| -RUN \ |
58 |
| - if [ "${USE_CN_MIRROR:-false}" = "true" ]; then \ |
59 |
| - npm config set registry https://registry.npmmirror.com/; \ |
60 |
| - fi && \ |
61 |
| - yarn install |
| 21 | +# 安装所有依赖,包括开发依赖 |
| 22 | +RUN yarn install |
62 | 23 |
|
63 | 24 | # 复制项目源代码
|
64 | 25 | COPY . .
|
65 | 26 |
|
66 | 27 | # 构建应用程序
|
67 | 28 | RUN yarn build
|
68 | 29 |
|
69 |
| -# 重新设置NODE_ENV为production |
| 30 | +# 删除 node_modules 目录 |
| 31 | +RUN rm -rf node_modules |
| 32 | + |
| 33 | +# 设置 NODE_ENV 为 production |
70 | 34 | ENV NODE_ENV=production
|
71 | 35 |
|
72 |
| -# 删除devDependencies,减小最终镜像大小 |
| 36 | +# 安装生产依赖 |
73 | 37 | RUN yarn install --production --ignore-scripts --prefer-offline
|
74 | 38 |
|
75 |
| -# 修改文件权限,使appuser拥有所有权 |
76 |
| -RUN chown -R appuser:appgroup /app |
77 |
| - |
78 |
| - |
| 39 | +# 清理 yarn 缓存 |
| 40 | +RUN yarn cache clean --all |
79 | 41 |
|
80 | 42 | # 阶段3:构建最终的生产镜像
|
81 |
| -FROM scratch |
| 43 | +FROM node:18-alpine |
| 44 | + |
| 45 | +# 设置工作目录 |
| 46 | +WORKDIR /app |
82 | 47 |
|
83 |
| -# 复制distroless文件 |
84 |
| -COPY --from=base /distroless / |
| 48 | +# 创建非 root 用户 |
| 49 | +RUN addgroup -g 1001 appgroup && \ |
| 50 | + adduser -D -u 1001 -G appgroup appuser |
85 | 51 |
|
86 | 52 | # 复制应用程序文件
|
87 |
| -COPY --from=builder /app /app |
| 53 | +COPY --from=builder /app/server.js /app/server.js |
| 54 | +COPY --from=builder /app/dist /app/dist |
| 55 | +COPY --from=builder /app/api /app/api |
| 56 | +COPY --from=builder /app/node_modules /app/node_modules |
| 57 | +COPY --from=builder /app/package.json /app/package.json |
| 58 | + |
| 59 | +# 修改文件权限,使 appuser 拥有所有权 |
| 60 | +RUN chown -R appuser:appgroup /app |
88 | 61 |
|
89 | 62 | # 设置环境变量
|
90 | 63 | ENV NODE_ENV=production
|
91 | 64 | ENV HOSTNAME="0.0.0.0"
|
92 | 65 | ENV PORT=13000
|
93 | 66 | ENV NODE_OPTIONS="--dns-result-order=ipv4first --use-openssl-ca"
|
94 | 67 |
|
95 |
| -# 设置工作目录 |
96 |
| -WORKDIR /app |
97 |
| - |
98 | 68 | # 暴露端口
|
99 | 69 | EXPOSE 13000
|
100 | 70 |
|
101 |
| -# 使用非root用户 |
| 71 | +# 使用非 root 用户 |
102 | 72 | USER appuser
|
103 | 73 |
|
104 | 74 | # 启动命令
|
105 |
| -ENTRYPOINT ["/bin/node"] |
106 |
| -CMD ["server.js"] |
| 75 | +CMD ["node", "server.js"] |
0 commit comments