Dockerfile

# --- Build stage ---
FROM node:24-alpine AS builder

WORKDIR /src

# Cache dependencies
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
RUN corepack enable pnpm && pnpm install --frozen-lockfile

# Build the application
COPY . .
RUN pnpm run build

# --- Runtime stage ---
FROM node:24-alpine

# Install ca-certificates for HTTPS requests
RUN apk add --no-cache ca-certificates

# Create a non-root user
RUN addgroup -S proxy && adduser -S proxy -G proxy

WORKDIR /app

# Copy built application and production dependencies
COPY --from=builder /src/dist ./dist
COPY --from=builder /src/package.json ./
COPY --from=builder /src/pnpm-lock.yaml ./
COPY --from=builder /src/pnpm-workspace.yaml ./

# Install only production dependencies
RUN corepack enable pnpm && pnpm install --prod --frozen-lockfile

# Switch to non-root user
USER proxy

# Expose default port (can be overridden via PORT env var)
EXPOSE 8080

ENTRYPOINT ["node", "dist/server.js"]