Docker audit

.dockerignore

@@ -0,0 +1,51 @@
+# See https://docs.docker.com/engine/reference/builder/#dockerignore-file for more about ignoring files.
+
+# Ignore git directory.
+/.git/
+/.gitignore
+
+# Ignore bundler config.
+/.bundle
+
+# Ignore all environment files.
+/.env*
+
+# Ignore all default key files.
+/config/master.key
+
+# Ignore all logfiles and tempfiles.
+/log/*
+/tmp/*
+!/log/.keep
+!/tmp/.keep
+
+# Ignore pidfiles, but keep the directory.
+/tmp/pids/*
+!/tmp/pids/
+!/tmp/pids/.keep
+
+# Ignore storage (uploaded files in development and any SQLite databases).
+/storage/*
+!/storage/.keep
+/tmp/storage/*
+!/tmp/storage/
+!/tmp/storage/.keep
+
+# Ignore assets.
+/node_modules/
+/public/assets
+
+# Ignore CI/CD service files.
+/.github
+
+# Ignore Kamal secrets/config.
+/.kamal
+
+# Ignore locally-installed gems; the build stage runs its own bundle install.
+/vendor/bundle
+
+# Ignore test-only artifacts and tooling not needed in the production image.
+/coverage
+/spec
+/cypress
+/cypress.config.js

Dockerfile

@@ -9,26 +9,6 @@ WORKDIR $APP_HOME
 ARG UID=1000
 ARG GID=1000
 
-#RUN apt-get update \
-# && apt-get install -y --no-install-recommends build-essential git curl \
-# && rm -rf /var/lib/apt/lists/* /usr/share/doc /usr/share/man \
-# && apt-get clean \
-# && groupadd -g "${GID}" ruby \
-# && useradd --create-home --no-log-init -u "${UID}" -g "${GID}" ruby \
-# && chown -R ruby:ruby $APP_HOME
-
-RUN bash -c "set -o pipefail && apt-get update \
-  && apt-get install -y --no-install-recommends build-essential curl git libpq-dev libyaml-dev \
-  && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key -o /etc/apt/keyrings/nodesource.asc \
-  && echo 'deb [signed-by=/etc/apt/keyrings/nodesource.asc] https://deb.nodesource.com/node_22.x nodistro main' | tee /etc/apt/sources.list.d/nodesource.list \
-  && apt-get update && apt-get install -y --no-install-recommends nodejs \
-  && corepack enable \
-  && rm -rf /var/lib/apt/lists/* /usr/share/doc /usr/share/man \
-  && apt-get clean \
-  && groupadd -g \"${GID}\" ruby \
-  && useradd --create-home --no-log-init -u \"${UID}\" -g \"${GID}\" ruby \
-  && mkdir /node_modules && chown ruby:ruby -R /node_modules /app_home"
-
 EXPOSE 3000
 
 ENTRYPOINT ["./bin/docker-entrypoint"]

Dockerfile.prod

@@ -3,11 +3,11 @@
 
 # This Dockerfile is designed for production, not development. Use with Kamal or build'n'run by hand:
 # docker build -t today .
-# docker run -d -p 80:80 -e RAILS_MASTER_KEY=<value from config/master.key> --name today today
+# docker run -d -p 3000:3000 -e RAILS_MASTER_KEY=<value from config/master.key> --name today today
 
 # For a containerized dev environment, see Dev Containers: https://guides.rubyonrails.org/getting_started_with_devcontainer.html
 
-# Make sure RUBY_VERSION matches the Ruby version in .ruby-version
+# Make sure RUBY_VERSION matches the Ruby version in the Gemfile
 ARG RUBY_VERSION=4.0
 FROM docker.io/library/ruby:$RUBY_VERSION-slim AS base
 
@@ -24,15 +24,15 @@ RUN apt-get update -qq && \
 ENV RAILS_ENV="production" \
     BUNDLE_DEPLOYMENT="1" \
     BUNDLE_PATH="/usr/local/bundle" \
-    BUNDLE_WITHOUT="development" \
+    BUNDLE_WITHOUT="development test" \
     LD_PRELOAD="/usr/local/lib/libjemalloc.so"
 
 # Throw-away build stage to reduce size of final image
 FROM base AS build
 
 # Install packages needed to build gems
 RUN apt-get update -qq && \
-    apt-get install --no-install-recommends -y build-essential git libyaml-dev pkg-config && \
+    apt-get install --no-install-recommends -y build-essential libyaml-dev pkg-config && \
     rm -rf /var/lib/apt/lists /var/cache/apt/archives
 
 # Install application gems
@@ -69,8 +69,7 @@ COPY --chown=rails:rails --from=build "${BUNDLE_PATH}" "${BUNDLE_PATH}"
 COPY --chown=rails:rails --from=build /rails /rails
 
 # Entrypoint prepares the database.
-#ENTRYPOINT ["/rails/bin/docker-entrypoint"]
+ENTRYPOINT ["/rails/bin/docker-entrypoint"]
 
-# Start server via Thruster by default, this can be overwritten at runtime
-EXPOSE 80
+EXPOSE 3000
 CMD ["./bin/rails", "server"]

bin/docker-entrypoint

@@ -1,11 +1,13 @@
 #!/bin/bash
-if bundle check
-then
-  echo "Bundle installing..."
-  bundle install > ${BUNDLE_PATH}/bundle_install
-  tail -n 2 ${BUNDLE_PATH}/bundle_install
-else
-  bundle install
+if [ "${RAILS_ENV}" != "production" ]; then
+  if bundle check
+  then
+    echo "Bundle installing..."
+    bundle install > ${BUNDLE_PATH}/bundle_install
+    tail -n 2 ${BUNDLE_PATH}/bundle_install
+  else
+    bundle install
+  fi
 fi
 
 # If running the rails server then create or migrate existing database