Improved web dockerfile

Author: jfmlima

.github/workflows/release.yml

@@ -41,7 +41,7 @@ jobs:
             docker run --rm ${{ env.IMAGE_PREFIX }}/cli:${{ github.ref_name }} --help
 
             # Run Web UI
-            docker run -p 80:80 ${{ env.IMAGE_PREFIX }}/web:${{ github.ref_name }}
+            docker run -p 8080:8080 ${{ env.IMAGE_PREFIX }}/web:${{ github.ref_name }}
             ```
 
             ## Changes

packages/web/.dockerignore

@@ -1,24 +1,15 @@
-# Dependencies
+# Dependencies (these will be installed via package.json)
 node_modules
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 
-# Development files
-src
-public
-*.md
+# Environment files (should be passed as build args)
 .env.local
 .env.development.local
 .env.test.local
 .env.production.local
 
-# Build tools
-vite.config.ts
-tsconfig.json
-tsconfig.app.json
-tsconfig.node.json
-
 # IDE and editor files
 .vscode
 .idea
@@ -38,7 +29,10 @@ Thumbs.db
 .git
 .gitignore
 
-# Misc
-*.log
+# Development artifacts
 coverage
 .nyc_output
+dist
+
+# Documentation (not needed for build)
+README.md

packages/web/Dockerfile

@@ -1,17 +1,24 @@
-# Multi-stage build for production
+# Build stage
 FROM node:20-alpine AS builder
 
+# Install security updates
+RUN apk update && apk upgrade && apk add --no-cache dumb-init
+
+# Create app user for security
+RUN addgroup -g 1001 -S nodejs && \
+    adduser -S nextjs -u 1001
+
 # Set working directory
 WORKDIR /app
 
-# Copy package files
+# Copy package files for dependency caching
 COPY package*.json ./
 
-# Install dependencies
-RUN npm ci --only=production
+# Install ALL dependencies (including dev deps for TypeScript compilation)
+RUN npm ci --include=dev && npm cache clean --force
 
 # Copy source code
-COPY . .
+COPY --chown=nextjs:nodejs . .
 
 # Build arguments for environment variables
 ARG VITE_BASE_API_URL
@@ -21,20 +28,43 @@ ENV VITE_BASE_API_URL=$VITE_BASE_API_URL
 RUN npm run build
 
 # Production stage
-FROM nginx:alpine
+FROM nginx:1.25-alpine AS runtime
+
+# Install security updates and curl for health checks
+RUN apk update && apk upgrade && \
+    apk add --no-cache curl dumb-init && \
+    rm -rf /var/cache/apk/*
+
+# Create non-root user
+RUN addgroup -g 1001 -S nginx-app && \
+    adduser -S nginx-app -u 1001 -G nginx-app
 
 # Copy built files from builder stage
-COPY --from=builder /app/dist /usr/share/nginx/html
+COPY --from=builder --chown=nginx-app:nginx-app /app/dist /usr/share/nginx/html
 
 # Copy nginx configuration
-COPY nginx.conf /etc/nginx/conf.d/default.conf
+COPY --chown=nginx-app:nginx-app nginx.conf /etc/nginx/conf.d/default.conf
 
-# Expose port 80
-EXPOSE 80
+# Set proper permissions
+RUN chown -R nginx-app:nginx-app /usr/share/nginx/html && \
+    chown -R nginx-app:nginx-app /var/cache/nginx && \
+    chown -R nginx-app:nginx-app /var/log/nginx && \
+    chown -R nginx-app:nginx-app /etc/nginx/conf.d && \
+    touch /var/run/nginx.pid && \
+    chown -R nginx-app:nginx-app /var/run/nginx.pid
+
+# Switch to non-root user
+USER nginx-app
+
+# Expose port 8080 (non-privileged port)
+EXPOSE 8080
 
 # Health check
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
-  CMD curl -f http://localhost/ || exit 1
+  CMD curl -f http://localhost:8080/health || curl -f http://localhost:8080/ || exit 1
+
+# Use dumb-init to handle signals properly
+ENTRYPOINT ["dumb-init", "--"]
 
 # Start nginx
 CMD ["nginx", "-g", "daemon off;"]

packages/web/nginx.conf

@@ -1,5 +1,5 @@
 server {
-    listen 80;
+    listen 8080;
     server_name localhost;
 
     root /usr/share/nginx/html;