Init

Dockerfile

@@ -0,0 +1,56 @@
+# syntax=docker/dockerfile:1.7
+#
+# FORGE — multi-stage build. Two sub-builds feed one slim runtime:
+#   - client (Vite/React) -> client/dist   (static assets)
+#   - server (tsc)        -> dist/index.js  (Express API + static server)
+#
+# Base pinned to a specific patch; bump deliberately. The runtime carries only
+# prod deps (`--omit=dev`) + the two build outputs, and runs as the non-root
+# `node` user.
+
+FROM node:20.19.6-alpine3.21 AS base
+
+# --- Stage 1: client build --------------------------------------------------
+FROM base AS client-build
+WORKDIR /build/client
+COPY client/package.json client/package-lock.json* ./
+RUN npm install
+COPY client/ ./
+RUN npm test
+RUN npm run build
+
+# --- Stage 2: server build --------------------------------------------------
+FROM base AS server-build
+WORKDIR /build
+COPY package.json package-lock.json* ./
+RUN npm install
+COPY tsconfig.json ./
+COPY index.ts ./
+COPY server/ ./server/
+RUN npx tsc
+
+# --- Stage 3: prod deps -----------------------------------------------------
+FROM base AS prod-deps
+WORKDIR /app
+COPY package.json package-lock.json* ./
+RUN npm install --omit=dev
+
+# --- Stage 4: runtime -------------------------------------------------------
+FROM base AS runtime
+WORKDIR /app
+ENV NODE_ENV=production \
+    PORT=3000
+
+COPY --from=prod-deps    --chown=node:node /app/node_modules ./node_modules
+COPY --from=server-build --chown=node:node /build/dist ./dist
+COPY --from=server-build --chown=node:node /build/server/data ./dist/server/data
+COPY --from=client-build --chown=node:node /build/client/dist ./client/dist
+COPY --chown=node:node package.json ./
+
+USER node
+EXPOSE 3000
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+  CMD wget --spider -q http://localhost:3000/healthz || exit 1
+
+CMD ["node", "dist/index.js"]