From 492b1da4bca69e2f630a4a2900a3eef1c88d7833 Mon Sep 17 00:00:00 2001 From: SJCoetz Date: Sun, 19 Jul 2026 21:32:39 +0200 Subject: [PATCH] build(docker): fix non-root user and pnpm setup replace corepack-based pnpm setup with global npm install to avoid per-user cache issues for the non-root runtime user. add -m flag and explicit home directory to the useradd command to ensure proper cache directory access, and update health check comments with additional context. --- Dockerfile | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/Dockerfile b/Dockerfile index cd9709f8..c48886e6 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,8 +9,9 @@ FROM node:22-bookworm-slim AS deps WORKDIR /app -# pnpm via corepack — matches the dev environment (pnpm 10.x) -RUN corepack enable && corepack prepare pnpm@10.30.3 --activate +# Install pnpm globally via npm (avoids corepack's per-user cache dance +# which fails for the non-root runtime user). +RUN npm install -g pnpm@10.30.3 # Copy only the manifests so the install layer caches well COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./ @@ -19,7 +20,7 @@ RUN pnpm install --frozen-lockfile # ─── Stage 2: build ──────────────────────────────────────────────────────────── FROM node:22-bookworm-slim AS builder WORKDIR /app -RUN corepack enable && corepack prepare pnpm@10.30.3 --activate +RUN npm install -g pnpm@10.30.3 COPY --from=deps /app/node_modules ./node_modules COPY . . @@ -38,11 +39,13 @@ ENV NEXT_TELEMETRY_DISABLED=1 ENV HOSTNAME=0.0.0.0 ENV PORT=4004 -RUN corepack enable && corepack prepare pnpm@10.30.3 --activate +RUN npm install -g pnpm@10.30.3 -# Non-root user for the runtime +# Non-root user with a proper home dir (the `-m` is critical — without it +# `useradd --system` skips home-dir creation, and pnpm/corepack can't write +# their cache to /home/nextjs). RUN groupadd --system --gid 1001 nodejs \ - && useradd --system --uid 1001 --gid nodejs nextjs + && useradd -m --system --uid 1001 --gid nodejs --home /home/nextjs nextjs # Copy the build artifacts COPY --from=builder --chown=nextjs:nodejs /app/public ./public @@ -53,7 +56,9 @@ COPY --from=builder --chown=nextjs:nodejs /app/package.json ./package.json USER nextjs EXPOSE 4004 -# Health check: hit the login page (no auth required) +# Health check: hit the login page (no auth required) using node's built-in http. +# If you switch the Coolify UI to a curl-based healthcheck, this still runs +# as a fallback inside the container. HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \ CMD node -e "require('http').get('http://127.0.0.1:'+process.env.PORT+'/login',r=>process.exit(r.statusCode<500?0:1)).on('error',()=>process.exit(1))"