ekklesiaandClaude Opus 5.5
756e9b821c
Add deploy/Dockerfile and .dockerignore (ADR 0044): one image for the api service and every operator-run CLI, built from an already-assembled workspace (the platform plus whatever modules/<id> the context holds). - node:24.18.0-trixie-slim pinned by index digest; pnpm via Corepack at the root packageManager version. - Build stage: frozen install, modules:validate, migrations:validate, build. Runtime: production-only node_modules plus every dist/, core migrations, and each module directory, in the repository layout the API and CLIs resolve paths from; root-owned, run as node. - NODE_ENV=production and EKKLESIA_API_HOST=0.0.0.0 inside the image only; the platform default stays 127.0.0.1. Configuration comes only from the environment; no .env enters the context or any layer. - HEALTHCHECK on /api/v1/health/ready with Node's fetch; OCI labels for source, revision, and version. - CI builds the image without modules: build only, no credentials, no push. - deploy/README.md documents the image, the read-only production posture (verified), init: true, and the exact CLI commands. Co-Authored-By: Claude Opus 5.5 <[email protected]>
26 lines
743 B
Plaintext
26 lines
743 B
Plaintext
# Build context for deploy/Dockerfile (ADR 0044). The image installs its own dependencies with
|
|
# `pnpm install --frozen-lockfile` and builds its own outputs, so nothing installed or built on the
|
|
# host may enter the context, and no secret or environment file may enter any layer.
|
|
|
|
# Host-installed dependencies and build outputs: the image produces its own.
|
|
**/node_modules
|
|
**/dist
|
|
**/.turbo
|
|
**/coverage
|
|
**/*.tsbuildinfo
|
|
|
|
# Environment and secret material. Configuration reaches the container only through its runtime
|
|
# environment; `.env.example` is excluded too, since nothing in the image reads it.
|
|
**/.env
|
|
**/.env.*
|
|
|
|
# Repository and tooling metadata the image never reads.
|
|
.git
|
|
.github
|
|
.gitea
|
|
.forgejo
|
|
.vscode
|
|
.idea
|
|
**/*.log
|
|
**/.DS_Store
|