qbit-scripting/worker/Dockerfile

# Supply approved immutable Node 24.22.2 trixie-slim and distroless nonroot
# runtime references. Neither stage has a default floating image tag.
ARG NODE_BUILD_IMAGE
ARG NODE_RUNTIME_IMAGE
FROM ${NODE_BUILD_IMAGE} AS build
WORKDIR /worker
COPY package.json package-lock.json ./
COPY LICENSE NOTICE ./
RUN test "$(node --version)" = "v24.22.2" && test "$(npm --version)" = "11.19.1"
RUN npm ci --ignore-scripts --no-audit --no-fund
COPY tsconfig.json ./
COPY src ./src
RUN npm run build && npm prune --omit=dev --ignore-scripts

FROM ${NODE_RUNTIME_IMAGE}
# Distroless has no shell or package manager. Keep the complete TypeScript
# package below so its shipped standard library declarations remain available.
USER 65532:65532
RUN ["/nodejs/bin/node", "-e", "if(process.versions.node!=='24.22.2'||process.getuid()!==65532)process.exit(1)"]
WORKDIR /worker
COPY --from=build /worker/dist ./dist
COPY --from=build /worker/node_modules ./node_modules
COPY --from=build /worker/package.json ./
COPY --from=build /worker/LICENSE /worker/NOTICE ./
ENTRYPOINT ["/nodejs/bin/node", "--max-old-space-size=128", "/worker/dist/entrypoint.js"]