Dockerfile

# syntax=docker/dockerfile:1

# --- Build Stage ---
FROM public.ecr.aws/docker/library/node:22.22.1-alpine3.23 AS builder
WORKDIR /app

# Install git for private repository access
RUN apk add --no-cache git

# Install dependencies
COPY package.json package-lock.json ./
RUN npm ci

# Copy the rest of the app
COPY . .

# If we have a pre-built .next directory from the workflow, use it
# Otherwise, build it in the container (for local development)
RUN if [ -f next-build.tar.gz ]; then \
  tar -xzf next-build.tar.gz; \
  else \
  npm run build; \
  fi

# --- Production Stage ---
FROM public.ecr.aws/docker/library/node:22.22.1-alpine3.23 AS runner
WORKDIR /app
ENV NODE_ENV=production

# Install git and upgrade system packages for security patches
RUN apk upgrade --no-cache && apk add --no-cache git

# Create non-root user before copying files (enables --chown)
RUN addgroup -g 1001 -S appgroup && adduser -S appuser -u 1001 -G appgroup

# Install only production dependencies
COPY package.json package-lock.json ./
RUN npm ci --omit=dev

# Copy built app from builder with proper ownership
COPY --from=builder --chown=appuser:appgroup /app/.next ./.next
COPY --from=builder --chown=appuser:appgroup /app/.flowbite-react ./.flowbite-react
COPY --from=builder --chown=appuser:appgroup /app/public ./public
COPY --from=builder --chown=appuser:appgroup /app/next.config.js ./next.config.js
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/package.json ./package.json

# Copy entrypoint script and set permissions
COPY --chown=appuser:appgroup bin/entrypoint.sh /app/bin/entrypoint.sh
RUN chmod +x /app/bin/entrypoint.sh

# Create cache directory with proper ownership
RUN mkdir -p /app/.next/cache/images && chown -R appuser:appgroup /app/.next/cache

USER appuser

EXPOSE 3000
ENV PORT=3000
ENTRYPOINT ["/app/bin/entrypoint.sh"]