Repository navigation
Expand file tree
/
Copy pathDockerfile
More file actions
154 lines (133 loc) · 8.05 KB
/
Copy pathDockerfile
File metadata and controls
154 lines (133 loc) · 8.05 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
ARG NODE_IMAGE=node:24.22.1-bookworm-slim@sha256:55fb5f5a527ea2c5c4a95f963e48ef90aa38c7b346054fdc8ee9957a2b55d205
# OS security patches come from apt, not from the node image, and the node image
# rarely changes. Without a changing input the upgrade layers below stay cached
# for months and ship known-fixed CVEs. Every workflow that publishes this image
# sets this to the build timestamp so those layers rebuild on each publish. A
# local `docker build` or compose build leaves it unset and caches as usual.
ARG APT_REFRESH=unset
FROM golang:1.26.10-alpine@sha256:9ce231b28998b32e116927c61aa5c406183061d4f3f2d61b292c88e7f6bdf7ca AS goose_builder
RUN go install github.com/pressly/goose/v3/cmd/goose@v3.27.1
FROM ${NODE_IMAGE} AS pruner
WORKDIR /triggerdotdev
COPY --chown=node:node . .
RUN npx -q turbo@2.10.0 prune --scope=webapp --docker
RUN find . -name "node_modules" -type d -prune -exec rm -rf '{}' +
# Base strategy to have layer caching
FROM ${NODE_IMAGE} AS base
ARG APT_REFRESH
RUN echo "apt refresh ${APT_REFRESH}" && apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends openssl dumb-init && rm -rf /var/lib/apt/lists/*
WORKDIR /triggerdotdev
COPY --chown=node:node .gitignore .gitignore
COPY --from=pruner --chown=node:node /triggerdotdev/out/json/ .
COPY --from=pruner --chown=node:node /triggerdotdev/out/pnpm-lock.yaml ./pnpm-lock.yaml
COPY --from=pruner --chown=node:node /triggerdotdev/out/pnpm-workspace.yaml ./pnpm-workspace.yaml
COPY --chown=node:node patches ./patches
## Dev deps
FROM base AS dev-deps
WORKDIR /triggerdotdev
# Corepack is used to install pnpm with the exact version from packageManager
RUN corepack enable && corepack prepare pnpm@10.33.2 --activate
ENV NODE_ENV=development
RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store pnpm install --no-frozen-lockfile
# Generate Prisma client here where all deps are installed
COPY --from=pruner --chown=node:node /triggerdotdev/internal-packages/database/prisma/schema.prisma /triggerdotdev/internal-packages/database/prisma/schema.prisma
RUN pnpx prisma@6.14.0 generate --schema /triggerdotdev/internal-packages/database/prisma/schema.prisma
COPY --from=pruner --chown=node:node /triggerdotdev/internal-packages/run-ops-database/prisma/schema.prisma /triggerdotdev/internal-packages/run-ops-database/prisma/schema.prisma
RUN pnpx prisma@6.14.0 generate --schema /triggerdotdev/internal-packages/run-ops-database/prisma/schema.prisma
## Production deps
FROM base AS production-deps
WORKDIR /triggerdotdev
# Corepack is used to install pnpm with the exact version from packageManager
RUN corepack enable && corepack prepare pnpm@10.33.2 --activate
ENV NODE_ENV=production
RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store pnpm install --prod --no-frozen-lockfile
## Builder (builds the webapp)
FROM base AS builder
# This is needed for the sentry-cli binary while building the webapp
ARG APT_REFRESH
RUN echo "apt refresh ${APT_REFRESH}" && apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends openssl dumb-init ca-certificates && rm -rf /var/lib/apt/lists/*
WORKDIR /triggerdotdev
# Corepack is used to install pnpm with the exact version from packageManager
RUN corepack enable && corepack prepare pnpm@10.33.2 --activate
ARG SENTRY_RELEASE
ARG SENTRY_ORG
ARG SENTRY_PROJECT
ARG SKIP_SENTRY_SOURCEMAP_UPLOAD
ENV SENTRY_RELEASE=${SENTRY_RELEASE} \
SENTRY_ORG=${SENTRY_ORG} \
SENTRY_PROJECT=${SENTRY_PROJECT} \
SKIP_SENTRY_SOURCEMAP_UPLOAD=${SKIP_SENTRY_SOURCEMAP_UPLOAD}
# Goose and schemas
COPY --from=goose_builder /go/bin/goose /usr/local/bin/goose
RUN chmod +x /usr/local/bin/goose
COPY --chown=node:node internal-packages/clickhouse/schema /triggerdotdev/internal-packages/clickhouse/schema
COPY --from=pruner --chown=node:node /triggerdotdev/out/full/ .
COPY --from=dev-deps --chown=node:node /triggerdotdev/ .
COPY --chown=node:node turbo.json turbo.json
COPY --chown=node:node docker/scripts ./scripts
RUN chmod +x ./scripts/wait-for-it.sh
RUN chmod +x ./scripts/entrypoint.sh
COPY --chown=node:node .configs/tsconfig.base.json .configs/tsconfig.base.json
COPY --chown=node:node scripts/updateVersion.ts scripts/updateVersion.ts
COPY --chown=node:node scripts/bundleSdkDocs.ts scripts/bundleSdkDocs.ts
COPY --chown=node:node scripts/retry-prisma-generate.mjs scripts/retry-prisma-generate.mjs
RUN pnpm run generate
RUN --mount=type=secret,id=sentry_auth_token \
SENTRY_AUTH_TOKEN=$(cat /run/secrets/sentry_auth_token) \
pnpm run build --filter=webapp...
# Runner
FROM ${NODE_IMAGE} AS runner
ARG APT_REFRESH
RUN echo "apt refresh ${APT_REFRESH}" && apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends openssl netcat-openbsd ca-certificates && rm -rf /var/lib/apt/lists/*
# Distrust the roots that chain to the compromised eMudhra intermediates (Oct 2026). The system
# bundle covers OpenSSL, goose and Prisma's engines; distrust-cas.cjs does the same for Node's
# bundled roots. Both can go once Debian's ca-certificates and Node drop these roots.
RUN sed -i -E \
-e 's#^(mozilla/emSign_(ECC_Root_CA_-_G3|Root_CA_-_C1|ECC_Root_CA_-_C3)\.crt)$#!\1#' \
-e 's#^mozilla/Comodo_AAA_Services_root\.crt$#!&#' \
/etc/ca-certificates.conf && update-ca-certificates --fresh
WORKDIR /triggerdotdev
ENV NODE_ENV=production
ENV NODE_OPTIONS=--require=/triggerdotdev/scripts/distrust-cas.cjs
COPY --from=base /usr/bin/dumb-init /usr/bin/dumb-init
COPY --from=pruner --chown=node:node /triggerdotdev/out/full/ .
COPY --from=production-deps --chown=node:node /triggerdotdev .
# Copy generated Prisma client from dev-deps
COPY --from=dev-deps --chown=node:node /triggerdotdev/internal-packages/database/generated ./internal-packages/database/generated
# Run-ops Prisma client (query engine + client). Only constructed when the split is enabled,
# but the image must carry it so a split-on deployment doesn't hit a missing query engine.
COPY --from=dev-deps --chown=node:node /triggerdotdev/internal-packages/run-ops-database/generated ./internal-packages/run-ops-database/generated
# These workspace packages stay external to the Vite SSR bundle, so their
# built entry points must ship in the image (core is the sdk's runtime dep).
COPY --from=builder --chown=node:node /triggerdotdev/internal-packages/database/dist ./internal-packages/database/dist
COPY --from=builder --chown=node:node /triggerdotdev/internal-packages/run-ops-database/dist ./internal-packages/run-ops-database/dist
COPY --from=builder --chown=node:node /triggerdotdev/packages/trigger-sdk/dist ./packages/trigger-sdk/dist
COPY --from=builder --chown=node:node /triggerdotdev/packages/core/dist ./packages/core/dist
COPY --from=builder --chown=node:node /triggerdotdev/apps/webapp/build/server.js ./apps/webapp/build/server.js
COPY --from=builder --chown=node:node /triggerdotdev/apps/webapp/build ./apps/webapp/build
COPY --from=builder --chown=node:node /triggerdotdev/apps/webapp/public ./apps/webapp/public
COPY --from=builder --chown=node:node /triggerdotdev/scripts ./scripts
# Goose and schemas
COPY --from=builder /usr/local/bin/goose /usr/local/bin/goose
COPY --from=builder --chown=node:node /triggerdotdev/internal-packages/clickhouse/schema /triggerdotdev/internal-packages/clickhouse/schema
# Build info
ARG BUILD_APP_VERSION
ARG BUILD_GIT_SHA
ARG BUILD_GIT_REF_NAME
ARG BUILD_TIMESTAMP_SECONDS
ARG BUILD_TIMESTAMP_RFC3339
ENV BUILD_APP_VERSION=${BUILD_APP_VERSION} \
BUILD_GIT_SHA=${BUILD_GIT_SHA} \
BUILD_GIT_REF_NAME=${BUILD_GIT_REF_NAME} \
BUILD_TIMESTAMP_SECONDS=${BUILD_TIMESTAMP_SECONDS}
LABEL org.opencontainers.image.source="https://github.com/triggerdotdev/trigger.dev" \
org.opencontainers.image.revision="${BUILD_GIT_SHA}" \
org.opencontainers.image.version="${BUILD_APP_VERSION}" \
org.opencontainers.image.created="${BUILD_TIMESTAMP_RFC3339}"
EXPOSE 3000
# Add global pnpm shims and install pnpm during build (root user)
RUN corepack enable && corepack prepare pnpm@10.33.2 --activate
USER node
# Ensure pnpm is installed during build and not silently downloaded at runtime (node user)
RUN corepack prepare pnpm@10.33.2 --activate
CMD ["./scripts/entrypoint.sh"]