Rene Nochebuena
b73b9ee022
- Cache-Control per file: no-cache for index.html + service workers, immutable 1y for content-hashed assets, 1h for the rest (Vite/CRA/Angular). Closes the stale-release trap at the HTTP layer that the v1.6.0 image fix closed at the container layer. - SPA fallback scoped to navigation: a missing asset (path w/ extension) or a non-HTML Accept now returns 404 instead of index.html (no more HTML-as-JS 'Unexpected token <'). - X-Content-Type-Options: nosniff on every response. - Image runs as a non-root 'spa' user. - README: caching table, fallback contract, and the Angular dist/<project>/browser/ note.
43 lines
1.6 KiB
Docker
43 lines
1.6 KiB
Docker
FROM golang:1.26-alpine AS builder
|
|
WORKDIR /app
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY . .
|
|
ARG VERSION=dev
|
|
RUN CGO_ENABLED=0 GOOS=linux go build \
|
|
-ldflags="-s -w" \
|
|
-o spa-server \
|
|
./cmd/spa-server
|
|
|
|
FROM alpine:3.21
|
|
RUN apk add --no-cache ca-certificates tzdata \
|
|
&& addgroup -S spa && adduser -S -G spa -H -s /sbin/nologin spa
|
|
WORKDIR /app
|
|
COPY --from=builder /app/spa-server .
|
|
|
|
ARG VERSION=dev
|
|
ARG GIT_SHA=unknown
|
|
ARG BASE_DIGEST=
|
|
|
|
LABEL org.opencontainers.image.source="https://code.nochebuena.dev/einherjar/spa-server"
|
|
LABEL org.opencontainers.image.version="$VERSION"
|
|
LABEL org.opencontainers.image.revision="$GIT_SHA"
|
|
LABEL org.opencontainers.image.base.name="alpine:3.21"
|
|
LABEL org.opencontainers.image.base.digest="$BASE_DIGEST"
|
|
LABEL dev.nochebuena.healthz="/health"
|
|
|
|
# Provide your SPA build at /srv/www — COPY dist/ in a downstream Dockerfile, or
|
|
# bind-mount it at runtime (-v /path/to/dist:/srv/www). No VOLUME is declared here
|
|
# on purpose: a VOLUME at this path creates an anonymous volume that `docker compose
|
|
# up` reuses across container recreation, shadowing a freshly COPY'd bundle with the
|
|
# previous build — a silent stale deploy (worse for PWAs, whose service worker then
|
|
# caches the stale ngsw.json). A runtime bind-mount works with or without it, and a
|
|
# child image cannot un-declare an inherited VOLUME, so it must not be declared at all.
|
|
|
|
# Drop root: the server is a static binary serving read-only files on a >1024 port,
|
|
# so it needs no privilege. COPY'd assets are world-readable, so the unprivileged
|
|
# user reads /srv/www without a chown.
|
|
USER spa
|
|
EXPOSE 8080
|
|
ENTRYPOINT ["/app/spa-server"]
|