Dockerfile.production

# syntax=docker/dockerfile:1

FROM node:hydrogen-alpine3.19 AS build

# node-modules-builder stage installs/compiles the node_modules folder
# Python version must be specified starting in alpine3.12
RUN apk update && apk upgrade && \
    apk --no-cache add --virtual native-deps \
    g++ gcc libgcc libstdc++ linux-headers autoconf automake make nasm python3 git curl && \
    npm install --quiet node-gyp -g
WORKDIR /build

COPY package.json package-lock.json ./
COPY shared/package.json shared/package-lock.json ./shared/
COPY frontend/package.json frontend/package-lock.json ./frontend/

# Allow running of postinstall scripts
# RUN npm config set unsafe-perm true
# --legacy-peer-deps flag
# A breaking change in the peer dependency resolution strategy was introduced in
# npm 7. This resulted in npm throwing an error when installing packages:
# npm ERR! code ERESOLVE
# npm ERR! ERESOLVE unable to resolve dependency tree
# See also:
# * https://stackoverflow.com/questions/66239691/what-does-npm-install-legacy-peer-deps-do-exactly-when-is-it-recommended-wh
# NOTE: This flag is used again later in the build process when calling npm prune.
RUN npm ci --legacy-peer-deps

COPY . ./

# These options are only used in the build stage, not the start stage.
ENV NODE_OPTIONS="--max-old-space-size=4096"

RUN npm run build

ARG APP_VERSION
ARG APP_URL
ARG REPO_URL

# Upload datadog source maps from secret mount, id MUST be `id=dd_api_key` in the docker build command
# Mount creates a file inside /run/secrets/dd_api_key, and source to load the environment variables
# For the content of the mounted file is only accessible in the RUN command where it’s referred in, use && command.
RUN --mount=type=secret,id=dd_api_key \
    export DATADOG_API_KEY=$(cat /run/secrets/dd_api_key) && \
    npx @datadog/datadog-ci sourcemaps upload ./dist/frontend \
    --service=formsg-react \
    --release-version=$APP_VERSION \
    --minified-path-prefix=$APP_URL \
    --repository-url=$REPO_URL

RUN npm prune --production --legacy-peer-deps

# This stage builds the final container
FROM node:hydrogen-alpine3.19
LABEL maintainer=FormSG<formsg@data.gov.sg>
WORKDIR /opt/formsg

# Install build from backend-build
COPY --from=build /build/node_modules /opt/formsg/node_modules
COPY --from=build /build/package.json /opt/formsg/package.json
COPY --from=build /build/dist /opt/formsg/dist

# Built backend goes back to root working directory
RUN mv /opt/formsg/dist/backend/src /opt/formsg/
RUN mv /opt/formsg/dist/backend/shared /opt/formsg/

# Install chromium from official docs
# https://github.com/puppeteer/puppeteer/blob/master/docs/troubleshooting.md#running-on-alpine
# Note that each alpine version supports a specific version of chromium
# Note that chromium and puppeteer-core are released together and it is the only version
# that is guaranteed to work. Upgrades must be done in lockstep.
# https://www.npmjs.com/package/puppeteer-core?activeTab=versions for corresponding versions

RUN apk add --no-cache \
    # Compatible chromium versions can be found here https://pkgs.alpinelinux.org/packages?name=chromium&branch=v3.19&repo=&arch=&maintainer=
    chromium=124.0.6367.78-r0 \
    nss \
    freetype \
    freetype-dev \
    harfbuzz \
    ca-certificates \
    ttf-freefont \
    tini

# Tell Puppeteer to skip installing Chrome. We'll be using the installed package.
ENV PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true
ENV PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser

# This package is needed to render Chinese characters in autoreply PDFs
RUN apk add font-wqy-zenhei --repository https://dl-cdn.alpinelinux.org/alpine/edge/community

ENV CHROMIUM_BIN=/usr/bin/chromium-browser

# Run as non-privileged user
RUN addgroup -S formsguser && adduser -S -g formsguser formsguser
USER formsguser

ENV NODE_ENV=production
EXPOSE 4545

# tini is the init process that will adopt orphaned zombie processes
# e.g. chromium when launched to create a new PDF
ENTRYPOINT [ "tini", "--" ]
CMD [ "npm", "start" ]