konnosDockerfile38 lines · main
| 1 | # syntax=docker/dockerfile:1.7 |
| 2 | # Base = oven/bun:1.3 (Debian) — see apps/web/Dockerfile for the libpg-query |
| 3 | # alpine-vs-debian rationale. |
| 4 | FROM oven/bun:1.3 AS base |
| 5 | RUN apt-get update -qq && \ |
| 6 | apt-get install -y --no-install-recommends \ |
| 7 | git python3 ca-certificates build-essential nodejs npm && \ |
| 8 | rm -rf /var/lib/apt/lists/* && \ |
| 9 | update-ca-certificates |
| 10 | RUN npm install -g pnpm@9.12.0 |
| 11 | |
| 12 | FROM base AS build |
| 13 | WORKDIR /repo |
| 14 | COPY . . |
| 15 | RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store \ |
| 16 | pnpm install --frozen-lockfile |
| 17 | |
| 18 | FROM oven/bun:1.3 AS runtime |
| 19 | WORKDIR /app |
| 20 | ENV NODE_ENV=production |
| 21 | ENV BRIVEN_RUNTIME_PORT=3003 |
| 22 | RUN groupadd -r app && useradd -r -g app app |
| 23 | COPY --from=build --chown=app:app /repo /app |
| 24 | # The runtime executes each user function inside a locked-down Deno isolate |
| 25 | # (BRIVEN_RUNTIME_EXECUTOR=deno — the multi-tenant security boundary). The base |
| 26 | # image is Bun, so the `deno` binary is copied in from Deno's official image. |
| 27 | # Without it the executor fails with: Executable not found in $PATH: "deno". |
| 28 | COPY --from=denoland/deno:bin-2.8.3 /deno /usr/local/bin/deno |
| 29 | # Create the bundle dir and chown it BEFORE switching to the non-root user. |
| 30 | # compose mounts the `runtime_bundles` named volume at /var/lib/briven/bundles; |
| 31 | # a fresh named volume inherits the ownership of this image directory on first |
| 32 | # creation, so it must already be app:app or the non-root process gets EACCES |
| 33 | # when it mkdir's the per-project bundle subfolder (bundle_fetch_failed). |
| 34 | RUN mkdir -p /var/lib/briven/bundles && chown -R app:app /var/lib/briven |
| 35 | USER app |
| 36 | EXPOSE 3003 |
| 37 | WORKDIR /app/apps/runtime |
| 38 | CMD ["bun", "run", "src/index.ts"] |