mirror of
https://github.com/Chevron7Locked/kima-hub.git
synced 2026-06-19 07:37:17 +00:00
Your Name
e918a34547
Critical for 1k+ production users - ensures smooth upgrades when pulling new Docker images. Changes: - Added migrate-safe.sh script that automatically baselines existing databases - Updated docker-entrypoint.sh to use safe migration script - Updated Dockerfile to include migration script in image - Manually applied missing config migration (SystemSettings columns) How it works for users: 1. User runs: docker compose pull 2. Container starts, runs migrate-safe.sh automatically 3. Script detects if database exists but isn't tracked (P3005 error) 4. If yes: baselines all existing migrations, then applies new ones 5. If no: runs normal migrate deploy Safety: - Zero data loss (only marks existing migrations as applied) - Idempotent (safe to run multiple times) - Graceful (continues even if status check unclear) - Production-tested on existing database with 30 migrations Result: - Users can docker compose pull without manual migration commands - Existing databases automatically get proper migration tracking - New migrations apply cleanly after baselining
69 lines
2.1 KiB
Docker
69 lines
2.1 KiB
Docker
# Stage 1: Dependencies (all deps for tsx runtime)
|
|
FROM node:20-slim AS deps
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy package files
|
|
COPY package*.json ./
|
|
COPY prisma ./prisma/
|
|
|
|
# Install ALL dependencies (tsx needs dev dependencies)
|
|
RUN npm ci && \
|
|
npm cache clean --force
|
|
|
|
# Generate Prisma Client
|
|
RUN npx prisma generate
|
|
|
|
# Stage 2: Production runtime (Hardened)
|
|
FROM node:20-slim
|
|
|
|
WORKDIR /app
|
|
|
|
# Install runtime dependencies first
|
|
# ffmpeg is required for audio transcoding
|
|
# openssl is required for Prisma
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ffmpeg \
|
|
tini \
|
|
openssl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Copy all node_modules (including tsx)
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY --from=deps /app/package*.json ./
|
|
COPY --from=deps /app/prisma ./prisma
|
|
|
|
# Copy source code (will run with tsx, not compiled)
|
|
COPY src ./src
|
|
|
|
# Copy healthcheck script, migration script, and shell entrypoint
|
|
COPY healthcheck.js ./
|
|
COPY migrate-safe.sh ./
|
|
COPY docker-entrypoint.sh /usr/local/bin/
|
|
|
|
# Create directories, fix line endings, set permissions, then remove dangerous tools
|
|
# NOTE: We keep /bin/sh because npm/npx require it to spawn processes
|
|
RUN mkdir -p /app/cache/covers /app/cache/transcodes /app/logs && \
|
|
sed -i 's/\r$//' /usr/local/bin/docker-entrypoint.sh && \
|
|
sed -i 's/\r$//' /app/migrate-safe.sh && \
|
|
chmod +x /usr/local/bin/docker-entrypoint.sh && \
|
|
chmod +x /app/migrate-safe.sh && \
|
|
chown -R node:node /app && \
|
|
# Remove download/network utilities (prevents downloading malware)
|
|
rm -f /usr/bin/wget /usr/bin/curl /bin/wget /bin/curl 2>/dev/null || true && \
|
|
rm -f /usr/bin/nc /bin/nc /usr/bin/ncat /usr/bin/netcat 2>/dev/null || true && \
|
|
rm -f /usr/bin/ftp /usr/bin/tftp /usr/bin/telnet 2>/dev/null || true
|
|
|
|
# Use non-root user
|
|
USER node
|
|
|
|
EXPOSE 3006
|
|
|
|
# Health check using Node.js (no wget needed)
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
|
|
CMD ["node", "healthcheck.js"]
|
|
|
|
# Use tini for proper signal handling
|
|
ENTRYPOINT ["/usr/bin/tini", "--", "docker-entrypoint.sh"]
|
|
CMD ["npx", "tsx", "src/index.ts"]
|