Zakaria
c5a2fc9105
- safeReturnTo resolves the target against a placeholder origin and rejects backslashes and control characters, so `/\evil.example` and similar payloads can no longer redirect off-site after sign-in. - Add a real unauthenticated /api/health and answer unknown /api/* paths with a JSON 404 instead of the SPA shell. - Limit request bodies: 16 KB for /api/auth/* (read before a session exists), 128 MB for resource create/update and uploads, 10 MB elsewhere. - Run the production image as an unprivileged user and add a Docker HEALTHCHECK against /api/health.
42 lines
1.5 KiB
Docker
42 lines
1.5 KiB
Docker
# Stage 1 — build frontend
|
|
FROM node:20-alpine AS frontend-build
|
|
WORKDIR /app
|
|
RUN corepack enable && corepack prepare pnpm@9.2.0 --activate
|
|
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
|
|
COPY packages/api/package.json packages/api/package.json
|
|
COPY packages/frontend/package.json packages/frontend/package.json
|
|
RUN pnpm install --frozen-lockfile --filter @floci/frontend
|
|
COPY packages/frontend/ packages/frontend/
|
|
COPY svgAsset/ svgAsset/
|
|
COPY aws-icons-svg/ aws-icons-svg/
|
|
COPY TheCloud.png TheCloud.png
|
|
COPY OS_img/ OS_img/
|
|
RUN pnpm --filter @floci/frontend run build
|
|
|
|
# Stage 2 — compile API to a self-contained binary
|
|
FROM oven/bun:1-alpine AS api-build
|
|
WORKDIR /app
|
|
COPY packages/api/package.json packages/api/bun.lock* ./
|
|
RUN bun install
|
|
COPY packages/api/src ./src
|
|
RUN bun build --compile --minify src/index.ts --outfile server
|
|
|
|
# Stage 3 — minimal runtime (no bun, no node_modules)
|
|
FROM alpine:3
|
|
RUN apk add --no-cache ca-certificates libstdc++ \
|
|
&& addgroup -S -g 10001 thecloud \
|
|
&& adduser -S -D -H -u 10001 -G thecloud thecloud
|
|
WORKDIR /app
|
|
COPY --from=api-build /app/server ./server
|
|
COPY --from=frontend-build /app/packages/frontend/dist ./public
|
|
COPY packages/api/public ./public
|
|
COPY TheCloud.png ./public/TheCloud.png
|
|
COPY svgAsset/authentik.svg ./public/authentik.svg
|
|
COPY aws-icons-svg ./public/aws-icons
|
|
ENV PORT=4500
|
|
EXPOSE 4500
|
|
USER thecloud
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD wget -q -O /dev/null "http://127.0.0.1:${PORT:-4500}/api/health" || exit 1
|
|
CMD ["./server"]
|