mirror of
https://github.com/penpot/penpot.git
synced 2026-10-28 21:40:34 +00:00
d1aa36b814
Bump the pnpm pin to 12.14.0 in the devenv and the production images and stamp the same version into every package.json, realigning the drift between the devenv (12.9.1) and the rest (12.6.0). Bump Node to v24.22.0, the newest patch of the Krypton LTS line, in .nvmrc, the devenv and image Dockerfiles and the plugins-deploy workflows. The pnpm arch checksums are those of the GitHub release tarballs, not of the npm package. Lockfile changes are metadata only. AI-assisted-by: deepseek-v4.1-flash
96 lines
2.8 KiB
Docker
96 lines
2.8 KiB
Docker
# syntax=docker/dockerfile:1
|
|
FROM dhi.io/node:24.22.0-debian13-dev
|
|
LABEL maintainer="Penpot <docker@penpot.app>"
|
|
|
|
ENV LANG=en_US.UTF-8 \
|
|
LC_ALL=en_US.UTF-8 \
|
|
DEBIAN_FRONTEND=noninteractive
|
|
|
|
# passwd provides useradd, not preinstalled on the DHI base image.
|
|
RUN set -ex; \
|
|
apt-get -qq update; \
|
|
apt-get -qqy --no-install-recommends install passwd; \
|
|
useradd -U -M -u 1001 -s /bin/false -d /opt/penpot penpot; \
|
|
apt-get -qqy --no-install-recommends install \
|
|
curl \
|
|
tzdata \
|
|
locales \
|
|
ca-certificates \
|
|
; \
|
|
apt-get clean; \
|
|
rm -rf /var/lib/apt/lists/*; \
|
|
echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen; \
|
|
locale-gen; \
|
|
find /usr/share/i18n/locales/ -type f ! -name "en_US" ! -name "POSIX" ! -name "C" -delete;
|
|
|
|
RUN set -ex; \
|
|
apt-get -qq update; \
|
|
apt-get -qqy --no-install-recommends install \
|
|
fontforge \
|
|
woff-tools \
|
|
woff2 \
|
|
\
|
|
libgomp1 \
|
|
libheif1 \
|
|
libjpeg62-turbo \
|
|
liblcms2-2 \
|
|
libopenjp2-7 \
|
|
libpng16-16 \
|
|
librsvg2-2 \
|
|
libtiff6 \
|
|
libwebp7 \
|
|
libwebpdemux2 \
|
|
libwebpmux3 \
|
|
libxml2 \
|
|
libzip5 \
|
|
libzstd1 \
|
|
; \
|
|
apt-get clean; \
|
|
rm -rf /var/lib/apt/lists/*; \
|
|
mkdir -p /opt/penpot; \
|
|
chown -R penpot:penpot /opt/penpot;
|
|
|
|
ARG BUNDLE_PATH="./bundle-media-processor/"
|
|
COPY --chown=penpot:penpot $BUNDLE_PATH /opt/penpot/media-processor/
|
|
|
|
WORKDIR /opt/penpot/media-processor
|
|
|
|
# pnpm ships as a system binary (same tarball + SHA pin as
|
|
# docker/devenv/Dockerfile); ./setup expects it on PATH.
|
|
# Corepack is gone from Node 25+, so nothing here may use it.
|
|
ARG PNPM_VERSION=12.14.0
|
|
RUN set -eux; \
|
|
apt-get -qq update; \
|
|
apt-get -qqy --no-install-recommends install gzip; \
|
|
rm -rf /var/lib/apt/lists/*; \
|
|
ARCH="$(dpkg --print-architecture)"; \
|
|
case "${ARCH}" in \
|
|
aarch64|arm64) \
|
|
PNPM_ARCH='arm64'; \
|
|
PNPM_SHA256='cfc780b9e690549e6633e1045fb1fb6ef84e390711e2099e6ccbae91c32456ea'; \
|
|
;; \
|
|
amd64|x86_64) \
|
|
PNPM_ARCH='x64'; \
|
|
PNPM_SHA256='3910c3852136bed5bc1511b9137a45fd4357ed6b3970d9d08893641e9005867e'; \
|
|
;; \
|
|
*) \
|
|
echo "Unsupported arch: ${ARCH}"; \
|
|
exit 1; \
|
|
;; \
|
|
esac; \
|
|
curl -LfsSo /tmp/pnpm.tar.gz "https://github.com/pnpm/pnpm/releases/download/v${PNPM_VERSION}/pnpm-linux-${PNPM_ARCH}.tar.gz"; \
|
|
echo "${PNPM_SHA256} */tmp/pnpm.tar.gz" | sha256sum -c -; \
|
|
mkdir -p /usr/local/bin; \
|
|
tar -xzf /tmp/pnpm.tar.gz -C /usr/local/bin pnpm; \
|
|
chmod 755 /usr/local/bin/pnpm; \
|
|
rm -f /tmp/pnpm.tar.gz; \
|
|
pnpm --version;
|
|
|
|
# Runs as root: this base image installs Node system-wide (symlinked into
|
|
# /usr/bin), so ./setup needs write access there.
|
|
RUN ./setup && chown -R penpot:penpot /opt/penpot/media-processor
|
|
|
|
USER penpot:penpot
|
|
|
|
CMD ["node", "dist/index.js"]
|