Lucas Winther
6eb77c8733
One build artifact serves both a self-hosted subpath deploy and GitHub Pages. CI runs the tests, typechecks, builds, and smoke-tests the image. server.ts's traversal guard uses a separator-aware check (resolved === root || resolved.startsWith(root + path.sep)) instead of a bare startsWith(root), which would let a request resolving to "/app/dist-evil/x" pass a check against root "/app/dist".
17 lines
355 B
Docker
17 lines
355 B
Docker
FROM oven/bun:1.3-alpine AS build
|
|
WORKDIR /app
|
|
COPY package.json bun.lock ./
|
|
RUN bun install --frozen-lockfile
|
|
COPY . .
|
|
ARG BUN_PUBLIC_BASE_PATH=/
|
|
ENV BUN_PUBLIC_BASE_PATH=$BUN_PUBLIC_BASE_PATH
|
|
RUN bun run build
|
|
|
|
FROM oven/bun:1.3-alpine
|
|
WORKDIR /app
|
|
COPY --from=build /app/dist ./dist
|
|
COPY server.ts ./
|
|
ENV PORT=3000
|
|
EXPOSE 3000
|
|
CMD ["bun", "server.ts"]
|