Flea Flicker
3e547b8568
The GRO-1983 fast restoration swapped Corepack's pnpm shim for a real
`npm install -g pnpm@9.15.4` binary, which is the right move. But the
GRO-1997 evidence gate still showed the first `reset-demo-data` pod
(...-nh7vg) hitting `getaddrinfo EAI_AGAIN registry.npmjs.org` before a
retry succeeded — the cache was writable, the cold-cache registry
download wasn't eliminated. This is the durable fix:
1. `ENV COREPACK_ENABLE_DOWNLOAD_FALLBACK=0` in `base` and `runner`:
defence in depth so a Corepack shim can never silently re-download
pnpm, even if it is somehow re-introduced.
2. `ENV HOME=/tmp` in the `migrate`, `seed`, and `reset` stages:
under `readOnlyRootFilesystem: true` + `runAsUser: 1000`, the
default HOME path is read-only, and pnpm fails the first time it
tries to write a config or state file. The job pods already mount a
writable emptyDir at `/tmp`; point HOME there.
3. CI smoke tests for `seed` and `reset` images (matching the existing
`migrate` smoke): point `registry.npmjs.org` at 127.0.0.1 in a
throwaway container, assert `which pnpm` resolves to
`/usr/local/bin/pnpm` (real binary, not shim), and that `pnpm
--version` succeeds without network egress. If Corepack ever sneaks
back in, CI catches it on every PR.
The vestigial `RUN mkdir -p /home/node/.cache/node/corepack` in the
`builder` stage (mentioned in the spec) was already removed in GRO-1909
(commit 0a3eb8a), so nothing to do there.
Follow-on cleanup of the per-job `COREPACK_HOME` env vars and
`node-cache` emptyDir mounts in `groombook/infra` is intentionally
deferred to a coordinated infra PR once the new image is deployed —
keeping the existing infra in place during the transition avoids a
flag-day.
GRO-1985, hardening follow-up to GRO-1984 / GRO-1983.
Closes parent: GRO-1981.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
70 lines
2.6 KiB
Docker
70 lines
2.6 KiB
Docker
FROM node:22-alpine AS base
|
|
# Install pnpm as a real binary via npm (not corepack shim) so runtime
|
|
# invocations of `pnpm` work without DNS access to registry.npmjs.org.
|
|
# The corepack shim delegates to corepack, which re-validates against
|
|
# npmjs.org on first use — that fails in air-gapped UAT seed/migrate/reset
|
|
# Jobs. GRO-1983 / GRO-1889 / GRO-1909 / GRO-1981 / GRO-1985.
|
|
RUN npm install -g pnpm@9.15.4
|
|
# Belt-and-braces: disable Corepack's download fallback so that even if a
|
|
# Corepack shim is somehow invoked at runtime, it will not try to fetch
|
|
# pnpm from registry.npmjs.org. Belt for the real-binary trousers. GRO-1985.
|
|
ENV COREPACK_ENABLE_DOWNLOAD_FALLBACK=0
|
|
WORKDIR /app
|
|
|
|
# Install deps
|
|
FROM base AS deps
|
|
COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
|
|
COPY packages/db/package.json packages/db/
|
|
COPY packages/types/package.json packages/types/
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
# Build
|
|
FROM deps AS builder
|
|
COPY packages/ packages/
|
|
COPY src/ src/
|
|
COPY tsconfig.json ./
|
|
RUN pnpm --filter @groombook/types build && \
|
|
pnpm --filter @groombook/db build && \
|
|
pnpm build
|
|
|
|
# Runtime
|
|
FROM node:22-alpine AS runner
|
|
RUN npm install -g pnpm@9.15.4
|
|
# Same defence-in-depth as base: no Corepack fallback. GRO-1985.
|
|
ENV COREPACK_ENABLE_DOWNLOAD_FALLBACK=0
|
|
WORKDIR /app
|
|
ENV NODE_ENV=production
|
|
|
|
COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
|
|
COPY --from=builder /app/package.json ./
|
|
COPY --from=builder /app/dist dist/
|
|
COPY --from=builder /app/packages/db/package.json packages/db/
|
|
COPY --from=builder /app/packages/db/dist packages/db/dist
|
|
COPY --from=builder /app/packages/types/package.json packages/types/
|
|
COPY --from=builder /app/packages/types/dist packages/types/dist
|
|
RUN pnpm install --frozen-lockfile --prod
|
|
|
|
EXPOSE 3000
|
|
RUN apk add --no-cache curl
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD curl -f http://localhost:3000/health || exit 1
|
|
CMD ["node", "dist/index.js"]
|
|
|
|
# Migrate stage — runs drizzle-kit migrate against the database
|
|
FROM builder AS migrate
|
|
# pnpm needs a writable HOME for any config/state it writes. With
|
|
# readOnlyRootFilesystem: true and runAsUser: 1000, /home/node is read-only.
|
|
# The job pods mount a writable emptyDir at /tmp; point HOME there. GRO-1985.
|
|
ENV HOME=/tmp
|
|
CMD ["pnpm", "--filter", "@groombook/db", "migrate"]
|
|
|
|
# Seed stage — populates the database with test data
|
|
FROM builder AS seed
|
|
ENV HOME=/tmp
|
|
CMD ["pnpm", "--filter", "@groombook/db", "seed"]
|
|
|
|
# Reset stage — drops all tables, re-runs migrations, and re-seeds
|
|
FROM builder AS reset
|
|
ENV HOME=/tmp
|
|
CMD ["pnpm", "--filter", "@groombook/db", "reset"]
|