Dockerfile

# syntax=docker/dockerfile:1

ARG NODE_VERSION=22-alpine

# ---- base: shared foundation for every other stage (stated once, not repeated) ----
FROM node:${NODE_VERSION} AS base
WORKDIR /app
RUN addgroup -S app && adduser -S app -G app
COPY package.json package-lock.json ./

# ---- deps: full install (deps + devDeps) — cached, reused by both dev and build ----
FROM base AS deps
RUN npm ci

# ---- dev: used only by docker-compose.dev.yml; source is bind-mounted, not copied.
# nodemon --legacy-watch forces polling so file-change events are seen through the bind
# mount on every host OS (Docker Desktop on macOS/Windows doesn't propagate native FS
# events into the container).
FROM deps AS dev
ENV NODE_ENV=development
EXPOSE 3000
CMD ["npx", "nodemon", "--legacy-watch", "--exec", "tsx", "--conditions=development", "src/index.ts"]

# ---- build: generate the Prisma client and compile TS7 -> dist/ ----
FROM deps AS build
# `prisma generate` only reads schema.prisma — it never connects to a database —
# but prisma.config.ts still requires DATABASE_URL to resolve. Real .env files are
# dockerignored (never baked into image layers), so give this stage a placeholder;
# the runtime image gets the real value from env_file at container start.
ENV DATABASE_URL="postgresql://user:password@localhost:5432/db"
COPY prisma ./prisma
COPY prisma.config.ts tsconfig.json tsconfig.build.json ./
COPY src ./src
RUN npx prisma generate
RUN npm run build

# ---- prod-deps: install *only* production deps — branches from `base`, not `deps`,
# so devDependencies never leak into the runtime image.
FROM base AS prod-deps
RUN npm ci --omit=dev --ignore-scripts

# ---- runtime: the image that actually ships ----
FROM base AS runtime
ENV NODE_ENV=production
COPY --from=prod-deps /app/node_modules ./node_modules
COPY --from=build /app/dist ./dist
COPY scripts/docker-healthcheck.mjs ./scripts/docker-healthcheck.mjs
USER app
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
  CMD ["node", "scripts/docker-healthcheck.mjs"]
CMD ["node", "--enable-source-maps", "dist/index.js"]