mirror of
https://github.com/InvoiceShelf/InvoiceShelf.git
synced 2026-07-18 14:55:21 +00:00
209a766c8c
Multi-arch builds run composer (incl. the merge-plugin's update) twice and exhausted GitHub's unauthenticated API rate limit, failing with 'Could not authenticate against github.com'. Pass the Actions token as a build secret and feed it to composer via COMPOSER_AUTH (build-time only, never in the image). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
53 lines
2.4 KiB
Docker
53 lines
2.4 KiB
Docker
# syntax=docker/dockerfile:1
|
|
FROM --platform=$BUILDPLATFORM node:24 AS static_builder
|
|
WORKDIR /var/www/html
|
|
COPY . /var/www/html
|
|
RUN corepack enable && pnpm install --frozen-lockfile && pnpm build
|
|
|
|
FROM serversideup/php:8.4-fpm-nginx-alpine AS base
|
|
USER root
|
|
RUN apk add --no-cache bash nano mariadb-client postgresql-client sqlite
|
|
RUN install-php-extensions exif
|
|
RUN install-php-extensions pgsql
|
|
RUN install-php-extensions sqlite3
|
|
RUN install-php-extensions imagick
|
|
RUN install-php-extensions mbstring
|
|
RUN install-php-extensions gd
|
|
RUN install-php-extensions xml
|
|
RUN install-php-extensions zip
|
|
RUN install-php-extensions redis
|
|
RUN install-php-extensions bcmath
|
|
RUN install-php-extensions intl
|
|
RUN install-php-extensions curl
|
|
|
|
FROM base AS production
|
|
ENV AUTORUN_ENABLED=true
|
|
ENV PHP_OPCACHE_ENABLE=1
|
|
|
|
# Set `www-data` as the user to start FPM
|
|
USER root
|
|
RUN echo "" >> /usr/local/etc/php-fpm.d/docker-php-serversideup-pool.conf && \
|
|
echo "user = www-data" >> /usr/local/etc/php-fpm.d/docker-php-serversideup-pool.conf && \
|
|
echo "group = www-data" >> /usr/local/etc/php-fpm.d/docker-php-serversideup-pool.conf
|
|
|
|
# Revert back to www-data, non-root user
|
|
USER www-data
|
|
|
|
# Copy application files first, then overlay the freshly-built frontend assets
|
|
# LAST. public/build is gitignored, so it's absent in CI but may exist in a local
|
|
# working tree — copying it after `COPY .` guarantees the stale host build can
|
|
# never clobber the fresh one produced by static_builder.
|
|
COPY --chown=www-data:www-data . /var/www/html
|
|
COPY --from=static_builder --chown=www-data:www-data /var/www/html/public/build /var/www/html/public/build
|
|
# Authenticate composer against GitHub when a token is provided (build secret),
|
|
# so multi-arch builds don't exhaust the unauthenticated API rate limit while the
|
|
# merge-plugin resolves modules. The secret is build-time only (never in the image),
|
|
# and the step still works without it for local builds.
|
|
RUN --mount=type=secret,id=composer_auth,mode=0444 \
|
|
COMPOSER_AUTH="$(cat /run/secrets/composer_auth 2>/dev/null || true)" \
|
|
composer install --prefer-dist --no-dev --optimize-autoloader
|
|
|
|
# Copy entrypoint and inject script, and make sure they are executable
|
|
COPY --chmod=755 docker/production/inject.sh /inject.sh
|
|
COPY --chmod=755 docker/production/entrypoint.d/ /etc/entrypoint.d/
|