Dockerfile

# syntax=docker/dockerfile:1
# check=error=true;skip=JSONArgsRecommended
# escape=\
FROM oven/bun:1

**/node_modules
**/dist
**/.next
.git
.env*
!.env.example
*.log
coverage
Dockerfile*
compose*.yaml

# ✅ lockfile first: source edits don't reinstall deps
COPY package.json bun.lock ./
RUN bun install --frozen-lockfile
COPY . .
RUN bun run build

# ❌ any source change reinstalls everything
COPY . .
RUN bun install --frozen-lockfile

# syntax=docker/dockerfile:1
FROM oven/bun:1 AS build
WORKDIR /app
COPY . .
RUN bun install --frozen-lockfile && bun run build
 
FROM build AS test
RUN bun test
 
FROM nginx:stable-alpine AS release
COPY --from=build /app/dist /usr/share/nginx/html

RUN --mount=type=secret,id=npmrc,target=/root/.npmrc \
    --mount=type=cache,target=/root/.npm \
    npm ci
 
RUN --mount=type=ssh \
    git clone git@github.com:acme/private.git /src

docker build --secret id=npmrc,src="$HOME/.npmrc" .
docker build --secret id=token,env=GH_TOKEN .
docker build --ssh default .

RUN rm -f /etc/apt/apt.conf.d/docker-clean
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update && apt-get install -y \
      --no-install-recommends ca-certificates curl

RUN <<EOF
set -eux
apt-get update
apt-get install -y --no-install-recommends curl
rm -rf /var/lib/apt/lists/*
EOF
 
COPY <<EOF /etc/app/config.toml
port = 3000
log_level = "info"
EOF
 
RUN <<EOF
#!/usr/bin/env bash
set -euo pipefail
echo "bash features here"
EOF

ARG NODE_VERSION=24
FROM node:${NODE_VERSION}-slim
ARG VERSION=dev
# promote a build arg to runtime
ENV APP_VERSION=$VERSION

FROM debian:trixie-slim
RUN groupadd --system --gid 10001 app \
 && useradd --system --uid 10001 --gid app \
      --no-create-home app
WORKDIR /app
# root-owned code: the app can't rewrite itself
COPY --chmod=0755 bin/ ./bin/
# writable dir for the app user
RUN mkdir /app/data && chown app:app /app/data
USER 10001:10001

# Debian: apt-get install -y tini
ENTRYPOINT ["tini", "--"]
CMD ["bun", "src/index.ts"]

const server = Bun.serve({
  port: Number(process.env.PORT ?? 3000),
  fetch: () => new Response("ok"),
});
 
async function shutdown(signal: NodeJS.Signals) {
  console.info(`${signal}: draining`);
  await server.stop(); // finish in-flight requests
  process.exit(0);
}
 
process.once("SIGTERM", shutdown);
process.once("SIGINT", shutdown);

COPY healthcheck.ts ./
HEALTHCHECK --interval=30s --timeout=3s \
  --start-period=10s --start-interval=2s \
  CMD ["bun", "healthcheck.ts"]

const port = process.env.PORT ?? "3000";
const url = `http://127.0.0.1:${port}/health`;
 
try {
  const res = await fetch(url, {
    signal: AbortSignal.timeout(2_000),
  });
  process.exit(res.ok ? 0 : 1);
} catch {
  process.exit(1);
}

ARG VERSION=dev REVISION=unknown SOURCE
LABEL org.opencontainers.image.source=$SOURCE \
      org.opencontainers.image.revision=$REVISION \
      org.opencontainers.image.version=$VERSION \
      org.opencontainers.image.licenses=MIT

docker buildx imagetools inspect node:24-slim \
  --format '{{json .Manifest.Digest}}'

ignored: [DL3008]  # unpinned apt versions
trustedRegistries: [docker.io, ghcr.io, dhi.io]
failure-threshold: warning

# syntax=docker/dockerfile:1
FROM oven/bun:1 AS base
WORKDIR /app
 
FROM base AS deps
COPY package.json bun.lock ./
RUN --mount=type=cache,target=/root/.bun/install/cache \
    bun install --frozen-lockfile
 
FROM deps AS dev
COPY . .
CMD ["bun", "--watch", "src/index.ts"]
 
FROM base AS prod-deps
COPY package.json bun.lock ./
RUN --mount=type=cache,target=/root/.bun/install/cache \
    bun install --frozen-lockfile --production
 
FROM base AS release
ENV NODE_ENV=production
COPY --from=prod-deps /app/node_modules node_modules
COPY package.json ./
COPY src ./src
USER bun
EXPOSE 3000
CMD ["bun", "src/index.ts"]

# syntax=docker/dockerfile:1
FROM ghcr.io/pnpm/pnpm:12 AS base
RUN pnpm runtime set node 24 -g
ENV CI=true
WORKDIR /app
COPY package.json pnpm-lock.yaml ./
 
FROM base AS build
RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
    pnpm install --frozen-lockfile
COPY . .
RUN pnpm run build
 
FROM base AS prod-deps
RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
    pnpm install --frozen-lockfile --prod
 
FROM node:24-trixie-slim
ENV NODE_ENV=production
WORKDIR /app
COPY --from=prod-deps /app/node_modules ./node_modules
COPY --from=build /app/dist ./dist
COPY package.json ./
USER node
CMD ["node", "dist/server.js"]

# syntax=docker/dockerfile:1
FROM node:24-slim AS base
WORKDIR /app
 
FROM base AS build
COPY --from=oven/bun:1 /usr/local/bin/bun /usr/local/bin/
COPY package.json bun.lock ./
RUN --mount=type=cache,target=/root/.bun/install/cache \
    bun install --frozen-lockfile
COPY . .
ENV NEXT_TELEMETRY_DISABLED=1
RUN bun run build
 
FROM base AS runner
ENV NODE_ENV=production PORT=3000 HOSTNAME=0.0.0.0
COPY --from=build --chown=node:node \
  /app/.next/standalone ./
COPY --from=build --chown=node:node \
  /app/.next/static ./.next/static
COPY --from=build --chown=node:node /app/public ./public
USER node
EXPOSE 3000
CMD ["node", "server.js"]

# syntax=docker/dockerfile:1
FROM oven/bun:1 AS build
WORKDIR /app
COPY package.json bun.lock ./
RUN bun install --frozen-lockfile
COPY . .
RUN bun run build
 
FROM nginxinc/nginx-unprivileged:stable-alpine
COPY nginx.conf /etc/nginx/conf.d/default.conf
COPY --from=build /app/dist /usr/share/nginx/html
EXPOSE 8080

server {
  listen 8080;
  root /usr/share/nginx/html;
 
  location / {
    try_files $uri $uri/ /index.html;  # SPA fallback
  }
  location /assets/ {
    add_header Cache-Control
      "public, max-age=31536000, immutable";
  }
}

# syntax=docker/dockerfile:1
FROM --platform=$BUILDPLATFORM golang:1.27 AS build
ARG TARGETOS TARGETARCH
WORKDIR /src
RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=bind,source=go.mod,target=go.mod \
    --mount=type=bind,source=go.sum,target=go.sum \
    go mod download
RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
    --mount=type=bind,target=. \
    CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \
    go build -trimpath -ldflags='-s -w' \
      -o /out/app ./cmd/app
 
FROM gcr.io/distroless/static-debian13:nonroot
COPY --from=build /out/app /app
USER nonroot:nonroot
EXPOSE 8080
ENTRYPOINT ["/app"]

# syntax=docker/dockerfile:1
FROM python:3.14-slim AS build
COPY --from=ghcr.io/astral-sh/uv:0.12.19 /uv /bin/
ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy \
    UV_PYTHON_DOWNLOADS=0 UV_NO_DEV=1
WORKDIR /app
COPY pyproject.toml uv.lock ./
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --locked --no-install-project --no-editable
COPY . .
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --locked --no-editable
 
FROM python:3.14-slim
RUN useradd --system --uid 10001 app
COPY --from=build /app/.venv /app/.venv
ENV PATH="/app/.venv/bin:$PATH"
USER app
EXPOSE 8000
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0"]