till
a495bba165
npm audit had one critical finding here (the Astro 5 advisories, among them the AVIF RCE) — irrelevant at runtime for a static site served by nginx, but the build toolchain ran it. Now 0. Build image node 20 -> 22, and npm ci only: the old '|| npm install' fallback meant a broken lockfile would silently build something untested. Checked in a real browser: all six pages 200, sheet drawn, PDF download measures 210.00 x 297.00 mm in both languages, no horizontal scroll at 390 px.
14 lines
421 B
Docker
14 lines
421 B
Docker
# Build the static site, then serve it with nginx. Two stages, so the image that
|
|
# runs carries no toolchain — about 50 MB instead of about 400.
|
|
FROM node:22-bookworm-slim AS build
|
|
WORKDIR /app
|
|
COPY package.json package-lock.json* ./
|
|
RUN npm ci --no-audit --no-fund
|
|
COPY . .
|
|
RUN npm run build
|
|
|
|
FROM nginx:alpine
|
|
COPY --from=build /app/dist /usr/share/nginx/html
|
|
COPY nginx.conf /etc/nginx/conf.d/default.conf
|
|
EXPOSE 80
|