doc-ops-mcp

# 使用多阶段构建减少最终镜像大小和安全风险 FROM node:18-alpine@sha256:c698ffe060d198dcc6647be78ea1683363f12d5d507dc5ec9855f1c55966ffdd AS builder WORKDIR /app # 只复制必要的文件 COPY package*.json pnpm-lock.yaml ./ RUN npm install -g pnpm@8.15.1 --registry=https://registry.npmjs.org/ RUN pnpm install --frozen-lockfile --prod --registry=https://registry.npmjs.org/ # 第二阶段：运行时镜像 FROM node:18-alpine@sha256:c698ffe060d198dcc6647be78ea1683363f12d5d507dc5ec9855f1c55966ffdd WORKDIR /app # 安装运行时依赖 RUN apk add --no-cache \ chromium=119.0.6045.159-r0 \ nss=3.94-r0 \ && rm -rf /var/cache/apk/* # 从构建阶段复制依赖 COPY --from=builder /app/node_modules ./node_modules # 明确指定需要复制的文件，避免敏感目录 COPY --chown=nodejs:nodejs dist/index.cjs ./dist/index.cjs # 使用条件复制，避免敏感文件 RUN mkdir -p ./resources && chown -R nodejs:nodejs ./resources # 创建非 root 用户并设置权限 RUN addgroup -g 1001 -S nodejs && \ adduser -S docops -u 1001 && \ chown -R docops:nodejs /app USER docops HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \ CMD node dist/index.cjs --health-check || exit 1 CMD ["node", "dist/index.cjs"]