Create Dockerfile

Dockerfile

@@ -0,0 +1,54 @@
+# =========================================================
+# STAGE 1: Hermetic Node Compiler and Code Bundler
+# =========================================================
+FROM node:20-alpine AS build-engine
+
+WORKDIR /app
+
+# Requires package-lock.json to exist via running npm install first locally
+COPY package*.json ./
+RUN npm ci
+
+# Mount compiler processing environments
+COPY tailwind.config.js postcss.config.js vite.config.js ./
+COPY index.html ./
+
+# Mount asset and source directories
+COPY public/ ./public/
+COPY src/ ./src/
+
+# Compile production build distributions into /app/dist
+ENV NODE_ENV=production
+RUN npm run build
+
+# =========================================================
+# STAGE 2: Hardened, Unprivileged Static Edge Server
+# =========================================================
+FROM nginx:alpine-slim
+
+# Enforce system-level wget availability to guarantee health checks survive baseline upgrades
+RUN apk add --no-cache wget \
+ && rm -rf /usr/share/nginx/html/* \
+ && rm -f /etc/nginx/conf.d/default.conf /etc/nginx/nginx.conf
+
+# Inject security configurations into global runtime path
+COPY nginx.conf /etc/nginx/nginx.conf
+
+# Extract tree-shaken static assets directly out of Stage 1 dist/
+COPY --from=build-engine /app/dist /usr/share/nginx/html
+
+# Create and register custom temp structures under explicit non-root contexts
+RUN mkdir -p /tmp/client_temp /tmp/proxy_temp /tmp/fastcgi_temp /tmp/uwsgi_temp /tmp/scgi_temp \
+ && chown -R nginx:nginx /usr/share/nginx/html /var/cache/nginx /var/log/nginx \
+                         /tmp/client_temp /tmp/proxy_temp /tmp/fastcgi_temp /tmp/uwsgi_temp /tmp/scgi_temp
+
+# Drop all execution privileges cleanly to non-root
+USER nginx
+
+EXPOSE 8080
+
+# Hardened Runtime Health Check evaluating index.html availability securely
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD wget -qO- http://localhost:8080/index.html >/dev/null || exit 1
+
+CMD ["nginx", "-g", "daemon off;"]