Dockerfile

ARG NODE_VERSION=26.12.1
ARG PNPM_VERSION=11.15.1

# ---- Build Base Stage ----
FROM node:${NODE_VERSION}-alpine AS base
WORKDIR /usr/src/app

# ---- Package Manager Stage ----
FROM base AS package-manager
# Pin pnpm so clean builds do not change behaviour when a new major is released.
ARG PNPM_VERSION
RUN npm install --global pnpm@${PNPM_VERSION}

# ---- Dependencies Stage ----
FROM package-manager AS deps
# Copy dependency-defining files
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
COPY tools ./tools
# Install dependencies
RUN pnpm install --frozen-lockfile

# ---- Build Stage ----
FROM deps AS build
COPY . .
# Build the application
RUN pnpm run test:dependency-compat && pnpm lint && pnpm build
RUN pnpm prune --prod

# ---- Production Stage ----
FROM alpine:3.24 AS production
ARG NODE_VERSION
ENV NODE_ENV=production
WORKDIR /usr/src/app

# Use Alpine's dynamically linked Node runtime so patched system OpenSSL packages
# can be upgraded independently. The final image intentionally contains no npm or
# pnpm executable and runs as a dedicated unprivileged account.
# Alpine replaces old package revisions; constrain Node to the builder's major
# version while allowing supported minor/patch releases and packaging revisions.
RUN apk upgrade --no-cache \
    && apk add --no-cache ca-certificates "nodejs-current~${NODE_VERSION%%.*}" \
    && addgroup -S -g 10001 app \
    && adduser -S -D -u 10001 -G app -h /home/app app

# Copy built application from the build stage
COPY --from=build --chown=app:app /usr/src/app/dist ./dist
COPY --from=build --chown=app:app /usr/src/app/sql ./sql
COPY --from=build --chown=app:app /usr/src/app/data ./data
# Copy only production dependencies after pruning build and test tools.
COPY --from=build --chown=app:app /usr/src/app/node_modules ./node_modules

# Expose the application port
EXPOSE 3000

# Do not grant report execution or database access through the container user.
USER app

# The command to run the application
CMD ["node", "dist/main.js"]