# syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
FROM node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2 AS build

ENV CI=true

WORKDIR /app

COPY package.json package-lock.json ./
RUN npm ci

COPY . .
RUN npm run build

FROM nginxinc/nginx-unprivileged:1.29-alpine@sha256:0c79d56aee561a1d81c63f00eee5fb5fe29279560cdc55e91425133104c7fbe6 AS runtime

COPY nginx.conf /etc/nginx/nginx.conf
COPY --chown=101:101 --from=build /app/dist /usr/share/nginx/html

USER 101:101
EXPOSE 8080

# The configuration is immutable and does not use envsubst templates, so skip
# the base entrypoint's mutation probes against the read-only filesystem.
ENTRYPOINT ["nginx"]
CMD ["-g", "daemon off;"]