Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 7 additions & 5 deletions Dockerfile
Original file line number Diff line number Diff line change
@@ -1,9 +1,11 @@
# syntax=docker/dockerfile:1
FROM node:24.4.0-slim AS base
ARG NODE_VERSION=24.4.0
FROM node:${NODE_VERSION}-slim AS base
ENV PNPM_HOME="/pnpm"
ENV PATH="$PNPM_HOME:$PATH"
RUN corepack enable
RUN corepack prepare pnpm@10.22.0 --activate
RUN corepack enable || true && \
corepack prepare pnpm@10.22.0 --activate || \
npm install -g pnpm@10.22.0
Comment on lines +6 to +8
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Silent failure in corepack enable

corepack enable || true always exits 0, so any genuine failure of corepack enable (e.g. a permissions issue on a node image that does include corepack) is silently ignored. The layer then proceeds to run corepack prepare, which will also fail and fall back to npm — leaving the image in a state where pnpm was installed via a different mechanism than expected, without any build-time warning.

A safer pattern is to check whether corepack is available first, rather than suppressing its errors unconditionally:

Suggested change
RUN corepack enable || true && \
corepack prepare pnpm@10.22.0 --activate || \
npm install -g pnpm@10.22.0
RUN if command -v corepack > /dev/null 2>&1; then \
corepack enable && corepack prepare pnpm@10.22.0 --activate; \
else \
npm install -g pnpm@10.22.0; \
fi


FROM base AS build
COPY . /usr/src/app
Expand Down Expand Up @@ -40,7 +42,7 @@ COPY --from=build /prod/dokploy/next.config.mjs ./next.config.mjs
COPY --from=build /prod/dokploy/public ./public
COPY --from=build /prod/dokploy/package.json ./package.json
COPY --from=build /prod/dokploy/drizzle ./drizzle
COPY .env.production ./.env
#COPY .env.production ./.env (# Env should be provided at runtime (not baked into image))
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Breaking change: .env.production no longer copied into image

Commenting out this line silently removes a file that the app may rely on to start. Any existing deployment that depended on .env.production being baked in (database URLs, secret keys, etc.) will now start without those values, causing runtime failures (DB connection errors, missing secrets, etc.) without a clear error message pointing back to the missing copy.

If the intent is to require runtime-supplied env vars going forward, this should be an explicit, documented migration step — not a silent comment-out. Consider keeping the COPY but guarding it conditionally, or at minimum adding a startup check that validates required variables are present.

COPY --from=build /prod/dokploy/components.json ./components.json
COPY --from=build /prod/dokploy/node_modules ./node_modules

Expand Down Expand Up @@ -69,4 +71,4 @@ EXPOSE 3000
HEALTHCHECK --interval=10s --timeout=3s --retries=10 \
CMD curl -fs http://localhost:3000/api/trpc/settings.health || exit 1

CMD ["sh", "-c", "pnpm run wait-for-postgres && exec pnpm start"]
CMD ["sh", "-c", "pnpm run wait-for-postgres && exec pnpm start"]