Skip to content

Dockerize API application with multi-stage build and update utils #49

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ChristianSanchez25 wants to merge 1 commit into
base: feat/new-template
Choose a base branch
from
+17,283 −10,987
Open

Dockerize API application with multi-stage build and update utils #49

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 60 additions & 0 deletions apps/api/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,60 @@
### Base Image
FROM node:24-alpine AS base
RUN apk add --no-cache git libc6-compat tzdata g++ make py3-pip && \
apk update
ENV TZ=America/Caracas

ENV SCOPE=@repo/api
ENV APP_PATH=apps/api


### Builder
FROM base AS builder
WORKDIR /app
COPY . .
RUN npx turbo prune --scope=${SCOPE} --docker

### Installer
FROM base AS installer
WORKDIR /app

# Install deps
COPY --from=builder /app/out/json/ .
COPY --from=builder /app/out/package-lock.json ./package-lock.json
RUN npm ci --no-audit

# Build project
COPY --from=builder /app/out/full/ .
COPY --from=builder /app/out/full/turbo.json turbo.json
RUN npx turbo build --filter=${SCOPE}

### Production Dependencies
FROM base AS prod-deps
WORKDIR /app
COPY --from=builder /app/out/json/ .
COPY --from=builder /app/out/package-lock.json ./package-lock.json
RUN npm ci --omit=dev --no-audit

### Runner
FROM node:24-alpine AS runner
RUN apk add --no-cache tzdata
ENV TZ=America/Caracas
ENV NODE_ENV=production
ENV APP_PATH=apps/api
WORKDIR /app

RUN addgroup --system --gid 1001 avilatek && \
adduser --system --uid 1001 nestjs
USER nestjs

COPY --from=prod-deps --chown=nestjs:nodejs /app/node_modules ./node_modules
COPY --from=installer --chown=nestjs:nodejs /app/packages ./packages
COPY --from=installer --chown=nestjs:nodejs /app/${APP_PATH}/dist ./${APP_PATH}/dist
COPY --from=installer --chown=nestjs:nodejs /app/${APP_PATH}/package.json ./${APP_PATH}/package.json
COPY --from=installer --chown=nestjs:nodejs /app/package.json ./package.json
Comment on lines +50 to +54

@sentry sentry Bot Mar 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The COPY --chown command in the Dockerfile references a non-existent group nodejs instead of the created avilatek group, causing file permission errors at runtime.
Severity: CRITICAL

Suggested Fix

In the Dockerfile, change all instances of COPY --chown=nestjs:nodejs to COPY --chown=nestjs:avilatek to correctly assign file ownership to the user and group created within the Docker image.

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: apps/api/Dockerfile#L50-L54

Potential issue: The Dockerfile creates a user group named `avilatek` but later attempts
to assign file ownership to a non-existent group `nodejs` using `COPY
--chown=nestjs:nodejs`. Docker silently ignores ownership changes when the specified
group does not exist, causing the files to be owned by `root`. Since the container runs
as the `nestjs` user, the application will not have the necessary permissions to read
its own files, leading to "permission denied" errors and causing the container to crash
upon startup.

Did we get this right? 👍 / 👎 to inform future reviews.


ENV PORT=3000
EXPOSE 3000

WORKDIR /app/${APP_PATH}
CMD ["node", "dist/src/main.js"]

@sentry sentry Bot Mar 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The Dockerfile CMD instruction points to an incorrect entry point path (dist/src/main.js) that does not match the actual build output location (dist/main.js).
Severity: CRITICAL

Suggested Fix

Update the CMD instruction in the Dockerfile to point to the correct entry point path. Change CMD ["node", "dist/src/main.js"] to CMD ["node", "dist/main.js"].

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: apps/api/Dockerfile#L60

Potential issue: The Dockerfile's `CMD` instruction specifies `dist/src/main.js` as the
application entry point. However, the NestJS build process, configured with `sourceRoot:
"src"`, compiles `src/main.ts` directly to `dist/main.js`, without preserving the `src`
directory in the output. When the container starts, it will attempt to execute a file at
a path that does not exist, resulting in an immediate "Error: Cannot find module" crash.

Did we get this right? 👍 / 👎 to inform future reviews.

2 changes: 1 addition & 1 deletion apps/api/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
"version": "0.1.0",
"description": "API Gateway for the backend app IN NEST!",
"scripts": {
"build": "nest build ./src",
"build": "nest build",
"format": "npx @biomejs/biome format --write",
"start": "nest start",
"dev": "nest start --watch",
Expand Down
Loading