Paperclip
17d261fa94
The seed/migrate/reset Jobs all invoke `pnpm` at runtime via the `pnpm --filter @groombook/db ...` CMD. In the current image, `/usr/local/bin/pnpm` is a symlink to corepack's pnpm.js shim, which delegates to corepack and re-validates the package against https://registry.npmjs.org on first use. The UAT pod network is air-gapped, so corepack fails with: Error: getaddrinfo EAI_AGAIN registry.npmjs.org This causes every seed Job to fail, leaving the Better Auth credential hashes frozen at their last successful seed run — even when the SealedSecret `seed-uat-passwords` is rotated. Replace `corepack install -g pnpm@9.15.4` with `npm install -g pnpm@9.15.4` in the base and runner stages. `npm install -g` writes the real pnpm binary to /usr/local/bin/pnpm, bypassing the corepack shim entirely. The seed, migrate, and reset stages inherit from builder (which inherits from base) so they all get the real pnpm without needing their own install line. The reset stage had a redundant corepack install that can be removed. GRO-1983, supersedes GRO-1909 (incomplete — corepack shim still tried to download pnpm at runtime). Co-Authored-By: Paperclip <noreply@paperclip.ing>
58 lines
1.9 KiB
Docker
58 lines
1.9 KiB
Docker
FROM node:22-alpine AS base
|
|
# Install pnpm as a real binary via npm (not corepack shim) so runtime
|
|
# invocations of `pnpm` work without DNS access to registry.npmjs.org.
|
|
# The corepack shim delegates to corepack, which re-validates against
|
|
# npmjs.org on first use — that fails in air-gapped UAT seed/migrate/reset
|
|
# Jobs. GRO-1983 / GRO-1889 / GRO-1909.
|
|
RUN npm install -g pnpm@9.15.4
|
|
WORKDIR /app
|
|
|
|
# Install deps
|
|
FROM base AS deps
|
|
COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
|
|
COPY packages/db/package.json packages/db/
|
|
COPY packages/types/package.json packages/types/
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
# Build
|
|
FROM deps AS builder
|
|
COPY packages/ packages/
|
|
COPY src/ src/
|
|
COPY tsconfig.json ./
|
|
RUN pnpm --filter @groombook/types build && \
|
|
pnpm --filter @groombook/db build && \
|
|
pnpm build
|
|
|
|
# Runtime
|
|
FROM node:22-alpine AS runner
|
|
RUN npm install -g pnpm@9.15.4
|
|
WORKDIR /app
|
|
ENV NODE_ENV=production
|
|
|
|
COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
|
|
COPY --from=builder /app/package.json ./
|
|
COPY --from=builder /app/dist dist/
|
|
COPY --from=builder /app/packages/db/package.json packages/db/
|
|
COPY --from=builder /app/packages/db/dist packages/db/dist
|
|
COPY --from=builder /app/packages/types/package.json packages/types/
|
|
COPY --from=builder /app/packages/types/dist packages/types/dist
|
|
RUN pnpm install --frozen-lockfile --prod
|
|
|
|
EXPOSE 3000
|
|
RUN apk add --no-cache curl
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD curl -f http://localhost:3000/health || exit 1
|
|
CMD ["node", "dist/index.js"]
|
|
|
|
# Migrate stage — runs drizzle-kit migrate against the database
|
|
FROM builder AS migrate
|
|
CMD ["pnpm", "--filter", "@groombook/db", "migrate"]
|
|
|
|
# Seed stage — populates the database with test data
|
|
FROM builder AS seed
|
|
CMD ["pnpm", "--filter", "@groombook/db", "seed"]
|
|
|
|
# Reset stage — drops all tables, re-runs migrations, and re-seeds
|
|
FROM builder AS reset
|
|
CMD ["pnpm", "--filter", "@groombook/db", "reset"]
|