Build the image in stages and run compiled JavaScript

.dockerignore

@@ -5,3 +5,5 @@ dist/
 .DS_Store
 .env
 .git
+.env.*
+!.env.example

.github/workflows/pull-request.yml

@@ -31,7 +31,7 @@ jobs:
     - name: Use Node.js
       uses: actions/setup-node@v4
       with:
-        node-version: v22.21.0
+        node-version: v22.23.4
         cache: 'npm'
         cache-dependency-path: '**/package-lock.json'
 

Dockerfile

@@ -1,21 +1,34 @@
-FROM node:22.23.4-bookworm-slim
+FROM node:22.23.4-bookworm-slim AS base
 LABEL org.opencontainers.image.source="https://github.com/jetkvm/cloud-api"
 WORKDIR /usr/src/app
 
-# Prisma needs OpenSSL at runtime
+# Prisma needs OpenSSL at runtime; tini forwards SIGTERM to node as PID 1
 RUN apt-get update \
-  && apt-get install -y --no-install-recommends openssl ca-certificates \
+  && apt-get install -y --no-install-recommends openssl ca-certificates tini \
   && rm -rf /var/lib/apt/lists/*
 
+FROM base AS build
 COPY package.json package-lock.json ./
 COPY prisma ./prisma
-# ts-node type-checks at startup, so the @types/* devDependencies are needed at runtime
 RUN npm ci
+COPY tsconfig.json ./
+COPY src ./src
+# Type errors fail the build here instead of crashing the container at startup
+RUN npx prisma generate \
+  && npm run build \
+  && npm prune --omit=dev
 
-COPY . .
-RUN npx prisma generate
-
+FROM base
 ENV NODE_ENV=production
 ENV PORT=3000
+COPY package.json ./
+COPY prisma ./prisma
+COPY --from=build /usr/src/app/node_modules ./node_modules
+COPY --from=build /usr/src/app/dist ./dist
+
+USER node
 EXPOSE 3000
-CMD ["npm", "run", "start"]
+HEALTHCHECK --interval=10s --timeout=5s --start-period=20s --retries=3 \
+  CMD ["node", "-e", "fetch('http://localhost:' + process.env.PORT + '/healthz').then(r => process.exit(r.ok ? 0 : 1), () => process.exit(1))"]
+ENTRYPOINT ["/usr/bin/tini", "--"]
+CMD ["node", "dist/index.js"]