# Image of frontend/: the built Astro site, served by astro preview.
# Built from the root of the repo (compose.yaml, or podman build -f frontend/Containerfile .).
# pnpm through corepack, never a global npm install; a non-root user ([HARDENED-CONTAINERS]).
FROM docker.io/library/node:24-trixie-slim@sha256:7f486cabe892bff8fef04c0f7da8dba84a560be3e4e2740b7a86afc57ebec315
RUN corepack enable
WORKDIR /srv/frontend
COPY frontend/package.json frontend/pnpm-lock.yaml frontend/pnpm-workspace.yaml ./
RUN pnpm install --frozen-lockfile --ignore-scripts
COPY frontend/ ./
RUN pnpm build && chown -R node /srv
# No telemetry from a server; Astro would also write its settings into a read-only home.
ENV ASTRO_TELEMETRY_DISABLED=1
USER node
EXPOSE 4321
# Started without pnpm: corepack would fetch pnpm at start, into a read-only file system.
CMD ["node_modules/.bin/astro", "preview", "--host", "0.0.0.0", "--port", "4321"]
