Files
rootandCursor 4ac0c16665 Harden production Docker stack for MySQL, API proxy, and builds.
Keep MySQL internal-only with env-based credentials, proxy /api/backend through nginx with Docker DNS refresh, and support host SOCKS/HTTP proxy during image builds.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-08 12:50:40 +00:00

54 lines
1.1 KiB
Docker

FROM node:20-alpine AS builder
WORKDIR /app
# Build-time proxy (host SOCKS on 127.0.0.1:1081 — requires docker build --network=host)
ARG HTTP_PROXY
ARG HTTPS_PROXY
ARG ALL_PROXY
ENV HTTP_PROXY=$HTTP_PROXY \
HTTPS_PROXY=$HTTPS_PROXY \
ALL_PROXY=$ALL_PROXY \
NODE_OPTIONS=--dns-result-order=ipv4first
COPY package*.json ./
COPY prisma ./prisma/
RUN npm ci
COPY . .
RUN npm run build
FROM node:20-alpine
WORKDIR /app
ARG HTTP_PROXY
ARG HTTPS_PROXY
ARG ALL_PROXY
ENV HTTP_PROXY=$HTTP_PROXY \
HTTPS_PROXY=$HTTPS_PROXY \
ALL_PROXY=$ALL_PROXY \
NODE_OPTIONS=--dns-result-order=ipv4first
RUN apk add --no-cache openssl
COPY package*.json ./
COPY prisma ./prisma/
# Keep devDependencies (tsx) so `prisma db seed` works on container start
RUN npm ci
# Do not keep proxy env in the final runtime image
ENV HTTP_PROXY= \
HTTPS_PROXY= \
ALL_PROXY=
COPY --from=builder /app/dist ./dist
# Seed runs via tsx and imports application modules from src/
COPY --from=builder /app/src ./src
EXPOSE 3001
CMD ["sh", "-c", "npx prisma migrate deploy && npx prisma db seed && node dist/server.js"]