21 lines
812 B
Docker
21 lines
812 B
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# Build stage: compile Sass and assemble the allowlisted dist/ folder.
|
|
# config.php never enters the image (.dockerignore), and build-dist.js
|
|
# doesn't copy it anyway.
|
|
FROM node:24-alpine AS build
|
|
WORKDIR /src
|
|
COPY package.json package-lock.json ./
|
|
RUN npm ci
|
|
COPY . .
|
|
RUN npm run dist
|
|
|
|
# Runtime stage. Production php.ini and expose_php = Off are baked in here,
|
|
# replacing the startup `command:` in docker-compose.yaml. Files are owned
|
|
# by root with 644/755 (normalized by build-dist.js), so www-data can read
|
|
# the site but not modify it; data/ and config/ arrive as mounts.
|
|
FROM php:8.5-apache
|
|
RUN cp "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini" \
|
|
&& printf 'expose_php = Off\n' > "$PHP_INI_DIR/conf.d/zz-hardening.ini"
|
|
COPY --from=build /src/dist/ /var/www/html/
|