Add Docker image for self-hosted deployment

- next.config: output "standalone" for a self-contained server bundle - Dockerfile: multi-stage build that runs as the node user, read-only-rootfs friendly (Next cache symlinked to /tmp), with a healthcheck - README: document deploying to playground.jun-liu.net Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-11-09 04:00:30 +00:00
parent 7c962d9d7b
commit c0b624554e
4 changed files with 53 additions and 2 deletions
@@ -0,0 +1,31 @@
+# Production image. Designed for a hardened runtime: read-only root filesystem,
+# a tmpfs at /tmp, no Linux capabilities, and a reverse proxy in front.
+
+FROM node:22-bookworm-slim AS deps
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm ci --no-audit --no-fund
+
+FROM node:22-bookworm-slim AS build
+WORKDIR /app
+ENV NEXT_TELEMETRY_DISABLED=1
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+RUN mkdir -p public && npm run build
+
+FROM node:22-bookworm-slim AS runtime
+WORKDIR /app
+ENV NODE_ENV=production \
+    NEXT_TELEMETRY_DISABLED=1 \
+    PORT=3000 \
+    HOSTNAME=0.0.0.0
+COPY --from=build --chown=node:node /app/.next/standalone ./
+COPY --from=build --chown=node:node /app/.next/static ./.next/static
+COPY --from=build --chown=node:node /app/public ./public
+# The root filesystem is read-only at runtime, so Next's cache goes to the /tmp tmpfs.
+RUN rm -rf .next/cache && ln -s /tmp/next-cache .next/cache
+USER node
+EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
+  CMD node -e "fetch('http://127.0.0.1:3000/').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+CMD ["node", "server.js"]