David/RJBULK-APP
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

build(docker): fix non-root user and pnpm setup

Browse source 
replace corepack-based pnpm setup with global npm install to avoid per-user cache issues for the non-root runtime user. add -m flag and explicit home directory to the useradd command to ensure proper cache directory access, and update health check comments with additional context.
This commit is contained in:
SJCoetz 2026-07-19 21:32:39 +02:00
parent cab91fb80f
commit 492b1da4bc
1 changed files with 12 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
Dockerfile
View file

@ -9,8 +9,9 @@
FROM node:22-bookworm-slim AS deps
WORKDIR /app
# pnpm via corepack — matches the dev environment (pnpm 10.x)
RUN corepack enable && corepack prepare pnpm@10.30.3 --activate
# Install pnpm globally via npm (avoids corepack's per-user cache dance
# which fails for the non-root runtime user).
RUN npm install -g pnpm@10.30.3
# Copy only the manifests so the install layer caches well
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
@ -19,7 +20,7 @@ RUN pnpm install --frozen-lockfile
# ─── Stage 2: build ────────────────────────────────────────────────────────────
FROM node:22-bookworm-slim AS builder
WORKDIR /app
RUN corepack enable && corepack prepare pnpm@10.30.3 --activate
RUN npm install -g pnpm@10.30.3
COPY --from=deps /app/node_modules ./node_modules
COPY . .
@ -38,11 +39,13 @@ ENV NEXT_TELEMETRY_DISABLED=1
ENV HOSTNAME=0.0.0.0
ENV PORT=4004
RUN corepack enable && corepack prepare pnpm@10.30.3 --activate
RUN npm install -g pnpm@10.30.3
# Non-root user for the runtime
# Non-root user with a proper home dir (the `-m` is critical — without it
# `useradd --system` skips home-dir creation, and pnpm/corepack can't write
# their cache to /home/nextjs).
RUN groupadd --system --gid 1001 nodejs \
&& useradd --system --uid 1001 --gid nodejs nextjs
&& useradd -m --system --uid 1001 --gid nodejs --home /home/nextjs nextjs
# Copy the build artifacts
COPY --from=builder --chown=nextjs:nodejs /app/public ./public
@ -53,7 +56,9 @@ COPY --from=builder --chown=nextjs:nodejs /app/package.json ./package.json
USER nextjs
EXPOSE 4004
# Health check: hit the login page (no auth required)
# Health check: hit the login page (no auth required) using node's built-in http.
# If you switch the Coolify UI to a curl-based healthcheck, this still runs
# as a fallback inside the container.
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
CMD node -e "require('http').get('http://127.0.0.1:'+process.env.PORT+'/login',r=>process.exit(r.statusCode<500?0:1)).on('error',()=>process.exit(1))"