mirror of
https://github.com/penpot/penpot.git
synced 2026-10-29 05:50:35 +00:00
e17c3c0c8f
- dhi.io/debian-base trixie-debian13-dev@61dc022 (docker/images/Dockerfile.backend) - dhi.io/debian-base trixie-debian13-dev@61dc022 (docker/images/Dockerfile.backend) - dhi.io/debian-base trixie-debian13@20079b5 (docker/imagemagick/Dockerfile) - dhi.io/debian-base trixie-debian13-dev@61dc022 (docker/imagemagick/Dockerfile) - dhi.io/debian-base trixie-debian13-dev@61dc022 (docker/devenv/Dockerfile) - dhi.io/nginx 1.31.6-alpine3.24@9465275 (docker/images/Dockerfile.storybook) - dhi.io/nginx 1.31.6-debian13-dev@32e4340 (docker/images/Dockerfile.frontend) - dhi.io/node 24.21.0-debian13-dev@2e51e83 (docker/images/Dockerfile.media-processor) - dhi.io/node 24.21.0-debian13@f3575cf (docker/images/Dockerfile.mcp) - dhi.io/node 24.21.0-debian13-dev@2e51e83 (docker/images/Dockerfile.mcp) - dhi.io/node 24.21.0-debian13-dev@2e51e83 (docker/images/Dockerfile.exporter) Signed-off-by: penpot-renovate[bot] <338182062+penpot-renovate[bot]@users.noreply.github.com>
53 lines
2.3 KiB
Docker
53 lines
2.3 KiB
Docker
FROM dhi.io/nginx:1.31.6-debian13-dev@sha256:32e434084ff7e82629abc090c534fa0b02ebf1a7465f8029314bf9e95349c3a1
|
|
LABEL maintainer="Penpot <docker@penpot.app>"
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
|
|
USER root
|
|
|
|
RUN set -ex; \
|
|
apt-get -qq update; \
|
|
apt-get -qqy -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" --no-install-recommends install bash gettext-base passwd; \
|
|
rm -rf /var/lib/apt/lists/*; \
|
|
groupadd -f -g 1001 penpot; \
|
|
useradd -M -u 1001 -s /usr/sbin/nologin -d /opt/penpot -g penpot penpot; \
|
|
mkdir -p /opt/data/assets; \
|
|
chown -R penpot:penpot /opt/data; \
|
|
mkdir -p /etc/nginx/overrides/main.d/; \
|
|
mkdir -p /etc/nginx/overrides/http.d/; \
|
|
mkdir -p /etc/nginx/overrides/server.d/; \
|
|
mkdir -p /etc/nginx/overrides/assets.d/; \
|
|
mkdir -p /etc/nginx/overrides/location.d/;
|
|
|
|
ARG BUNDLE_PATH="./bundle-frontend/"
|
|
COPY $BUNDLE_PATH /var/www/app/
|
|
COPY ./files/config.js /var/www/app/js/config.js
|
|
COPY ./files/nginx.conf.template /tmp/nginx.conf.template
|
|
COPY ./files/nginx-resolvers.conf.template /tmp/resolvers.conf.template
|
|
COPY ./files/nginx-admin-console-locations.conf.template /tmp/nginx-admin-console-locations.conf.template
|
|
COPY ./files/nginx-mcp-locations.conf.template /tmp/nginx-mcp-locations.conf.template
|
|
COPY ./files/nginx-security-headers.conf.template /tmp/nginx-security-headers.conf.template
|
|
COPY ./files/nginx-mime.types /etc/nginx/mime.types
|
|
COPY ./files/nginx-external-locations.conf /etc/nginx/overrides/location.d/external-locations.conf
|
|
COPY ./files/nginx-entrypoint.sh /entrypoint.sh
|
|
|
|
# The CSP hashes of the inline scripts of index.html are emitted by the
|
|
# frontend build. Move them out of the document root: nginx must read them,
|
|
# the browser has no reason to.
|
|
RUN if [ -f /var/www/app/csp-script-hashes.txt ]; then \
|
|
mv /var/www/app/csp-script-hashes.txt /etc/nginx/csp-script-hashes.txt; \
|
|
else \
|
|
echo "WARNING: the frontend bundle does not provide csp-script-hashes.txt" >&2; \
|
|
fi
|
|
|
|
RUN chown -R 1001:0 /var/cache/nginx; \
|
|
chmod -R g+w /var/cache/nginx; \
|
|
chown -R 1001:0 /etc/nginx; \
|
|
chmod -R g+w /etc/nginx; \
|
|
chown -R 1001:0 /var/www; \
|
|
chmod -R g+w /var/www;
|
|
|
|
USER penpot:penpot
|
|
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
|
|
CMD ["nginx", "-g", "daemon off;"]
|