mirror of
https://github.com/nexu-io/open-design.git
synced 2026-05-31 19:04:39 +07:00
369d136d19
* Add Docker Compose deployment workflow * Address Docker deployment review feedback Harden publishing inputs and temporary credential handling, and tighten Docker runtime defaults requested by the PR review. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Fix Docker publish build in CI mode Set CI=true during the image build so pnpm prune can run non-interactively inside Docker. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Fix Docker runtime dependency layout Use pnpm deploy for the daemon package so the runtime image includes production dependencies where Node resolves them. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Use legacy pnpm deploy in Docker build Allow pnpm v10 deploy to package the daemon workspace without requiring injected workspace packages. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Align Docker runtime with Node 24 Use Node 24 for both build and runtime stages and update image verification for the workspace daemon dependency layout. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Remove legacy OD_HOST Docker binding fallback Use OD_BIND_HOST as the single daemon bind-host setting for Docker deployment and origin validation. * Update Docker image verifier for daemon dist runtime Check the packaged daemon dist entrypoint and allow npm from the Node 24 runtime image while still rejecting build-only tools. * Allow private LAN browser origins for daemon * Share daemon origin validation helpers Move browser origin validation into a shared daemon module so tests exercise the production logic and cover the remaining private LAN edge cases. * Harden Docker Compose port exposure Bind the Compose deployment to localhost by default and pass the published port through to the daemon origin checks so host-port overrides remain same-origin. * Keep deployment hosts out of local-only no-origin checks Require an actual matching Origin before configured deployment origins can satisfy local-only daemon guards, preventing no-Origin remote clients from bypassing those checks. --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: mrcfps <mrc@powerformer.com> Co-authored-by: lefarcen <935902669@qq.com>
97 lines
3 KiB
Docker
97 lines
3 KiB
Docker
ARG NODE_IMAGE=docker.io/library/node:24-alpine
|
|
ARG RUNTIME_IMAGE=docker.io/library/node:24-alpine
|
|
|
|
FROM ${NODE_IMAGE} AS build
|
|
|
|
ARG HTTP_PROXY
|
|
ARG HTTPS_PROXY
|
|
ARG http_proxy
|
|
ARG https_proxy
|
|
ARG no_proxy
|
|
ARG NO_PROXY
|
|
|
|
ENV HTTP_PROXY=${HTTP_PROXY}
|
|
ENV HTTPS_PROXY=${HTTPS_PROXY}
|
|
ENV http_proxy=${http_proxy}
|
|
ENV https_proxy=${https_proxy}
|
|
ENV no_proxy=${no_proxy}
|
|
ENV NO_PROXY=${NO_PROXY}
|
|
ENV CI=true
|
|
|
|
RUN apk add --no-cache python3 make g++
|
|
|
|
WORKDIR /app
|
|
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
|
|
COPY scripts/postinstall.mjs ./scripts/postinstall.mjs
|
|
COPY packages ./packages
|
|
COPY tools ./tools
|
|
COPY apps/daemon/package.json ./apps/daemon/package.json
|
|
COPY apps/web/package.json ./apps/web/package.json
|
|
COPY e2e/package.json ./e2e/package.json
|
|
RUN corepack enable && \
|
|
corepack prepare pnpm@10.33.2 --activate && \
|
|
pnpm install --frozen-lockfile
|
|
|
|
COPY apps ./apps
|
|
RUN pnpm --filter @open-design/daemon build && \
|
|
pnpm --filter @open-design/web build && \
|
|
pnpm --filter @open-design/daemon deploy --legacy --prod /app/deploy/daemon && \
|
|
pnpm store prune && \
|
|
rm -rf \
|
|
/root/.cache \
|
|
/root/.local/share/pnpm/store \
|
|
/app/deploy/daemon/node_modules/.cache \
|
|
/app/deploy/daemon/node_modules/@types \
|
|
/app/deploy/daemon/node_modules/.pnpm/@types+* \
|
|
/app/deploy/daemon/node_modules/.pnpm/better-sqlite3@*/node_modules/better-sqlite3/deps \
|
|
/app/deploy/daemon/node_modules/.pnpm/better-sqlite3@*/node_modules/better-sqlite3/src && \
|
|
find /app/deploy/daemon/node_modules -type d \( \
|
|
-name test -o \
|
|
-name tests -o \
|
|
-name "__tests__" -o \
|
|
-name docs -o \
|
|
-name doc -o \
|
|
-name example -o \
|
|
-name examples -o \
|
|
-name ".github" \
|
|
\) -prune -exec rm -rf '{}' + && \
|
|
find /app/deploy/daemon/node_modules -type f \( \
|
|
-name "*.md" -o \
|
|
-name "*.markdown" -o \
|
|
-name "*.d.ts" -o \
|
|
-name "*.d.cts" -o \
|
|
-name "*.d.mts" -o \
|
|
-name "*.map" -o \
|
|
-name "*.tsbuildinfo" -o \
|
|
-name "binding.gyp" \
|
|
\) -delete
|
|
|
|
FROM ${RUNTIME_IMAGE}
|
|
|
|
RUN apk add --no-cache tini && \
|
|
addgroup -S -g 1001 open-design && \
|
|
adduser -S -D -H -u 1001 -G open-design open-design
|
|
|
|
WORKDIR /app
|
|
COPY --from=build --chown=open-design:open-design /app/deploy/daemon ./apps/daemon
|
|
COPY --from=build --chown=open-design:open-design /app/apps/web/out ./apps/web/out
|
|
COPY --chown=open-design:open-design skills ./skills
|
|
COPY --chown=open-design:open-design design-systems ./design-systems
|
|
COPY --chown=open-design:open-design craft ./craft
|
|
COPY --chown=open-design:open-design prompt-templates ./prompt-templates
|
|
COPY --chown=open-design:open-design assets/frames ./assets/frames
|
|
COPY --chown=open-design:open-design assets/community-pets ./assets/community-pets
|
|
|
|
RUN mkdir -p /app/.od && \
|
|
chown -R open-design:open-design /app
|
|
|
|
ENV NODE_ENV=production
|
|
ENV NODE_OPTIONS=--max-old-space-size=192
|
|
ENV OD_BIND_HOST=0.0.0.0
|
|
ENV OD_PORT=7456
|
|
|
|
EXPOSE 7456
|
|
|
|
USER open-design
|
|
ENTRYPOINT ["/sbin/tini", "--"]
|
|
CMD ["node", "apps/daemon/dist/cli.js", "--no-open"]
|