Dockerfile

# ──────────────────────────────────────────────────────────────────────────
# Evolith Tracker Web (React + Vite SPA) — multi-stage build → nginx.
#
# BUILD CONTEXT: the tracker monorepo `src/` directory (the folder with the
# root package.json / nx.json).
#   docker build -f apps/tracker-web/Dockerfile -t evolith-tracker-web:local src/
#
# The SPA reads its BFF base URL from VITE_TRACKER_BFF_BASE_URL at BUILD time
# (import.meta.env). We default it to the relative path `/api`, and nginx (see
# nginx.conf) proxies `/api` → the tracker-api service, so the same image works
# in any cluster without rebuilding. Override VITE_TRACKER_BFF_BASE_URL as a
# build-arg to bake an absolute URL instead.
# ──────────────────────────────────────────────────────────────────────────
FROM node:20-alpine AS build

WORKDIR /repo

# Install deps against the monorepo lockfile first (layer caching).
COPY package.json package-lock.json nx.json tsconfig.base.json ./
RUN npm ci --legacy-peer-deps

# Bring in the workspace and build only the web app via the Nx/Vite target.
COPY . ./

ARG VITE_TRACKER_BFF_BASE_URL=/api
ENV VITE_TRACKER_BFF_BASE_URL=${VITE_TRACKER_BFF_BASE_URL}

RUN npx nx build tracker-web --configuration=production \
    || npx nx build tracker-web

# ── Runtime: rootless nginx serving the static SPA ─────────────────────────
# nginx-unprivileged runs as uid 101 with writable temp/cache paths and an
# entrypoint that envsubsts templates into a writable dir — so it starts cleanly
# under a hardened (non-root) pod securityContext.
FROM nginxinc/nginx-unprivileged:1.27-alpine AS runtime

LABEL org.opencontainers.image.title="Evolith Tracker Web"
LABEL org.opencontainers.image.source="https://github.com/beyondnetcode/evolith_tracker"

USER root
RUN apk add --no-cache curl
USER 101

# Vite build output lands in dist/apps/tracker-web (see vite.config.mts).
COPY --from=build /repo/dist/apps/tracker-web /usr/share/nginx/html
COPY apps/tracker-web/nginx.conf /etc/nginx/templates/default.conf.template

# `TRACKER_API_UPSTREAM` is substituted into the nginx config at container
# start (the entrypoint runs /docker-entrypoint.d/20-envsubst-on-templates.sh),
# so the `/api` proxy target is configurable per environment.
ENV TRACKER_API_UPSTREAM=http://evolith-tracker-api:80

EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
  CMD curl -f http://localhost:8080/healthz || exit 1