# Image of frontend/: the built React app, served by vite preview.
# Built from the root of the repo (compose.yaml, or podman build -f frontend/Containerfile .).
# pnpm through corepack, never a global npm install; a non-root user ([HARDENED-CONTAINERS]).
FROM docker.io/library/node:24-trixie-slim@sha256:43b9ba1142b8dcf33fa8f922ca1be85714adc444e0586c7cf7726daaeabc1bea
RUN corepack enable
WORKDIR /srv/frontend
COPY frontend/package.json frontend/pnpm-lock.yaml frontend/pnpm-workspace.yaml ./
RUN pnpm install --frozen-lockfile --ignore-scripts
COPY frontend/ ./
RUN pnpm build && chown -R node /srv
USER node
EXPOSE 4173
# Started without pnpm: corepack would fetch pnpm at start, into a read-only file system.
CMD ["node_modules/.bin/vite", "preview", "--host", "0.0.0.0", "--port", "4173"]
