Viết Dockerfile

# syntax=docker/dockerfile:1.7

FROM node:22-bookworm-slim AS base
ENV PNPM_HOME="/pnpm"
ENV PATH="$PNPM_HOME:$PATH"
RUN corepack enable

FROM base AS dependencies
WORKDIR /app
COPY package.json pnpm-lock.yaml ./
RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
    pnpm install --frozen-lockfile

FROM dependencies AS build
COPY . .
RUN pnpm run build \
    && pnpm prune --prod

FROM node:22-bookworm-slim AS production
ENV NODE_ENV=production
WORKDIR /app

RUN apt-get update \
    && apt-get install -y --no-install-recommends ffmpeg curl \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd --system --gid 1001 nodeapp \
    && useradd --system --uid 1001 --gid nodeapp --create-home nodeapp

COPY --from=build --chown=nodeapp:nodeapp /app/package.json ./
COPY --from=build --chown=nodeapp:nodeapp /app/node_modules ./node_modules
COPY --from=build --chown=nodeapp:nodeapp /app/dist ./dist

USER nodeapp
EXPOSE 3000

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD curl --fail --silent http://127.0.0.1:3000/health || exit 1

CMD ["node", "dist/index.js"]

node_modules
dist
.git
.gitignore
.env
.env.*
!.env.example
Dockerfile*
docker-compose*.yml
npm-debug.log*
pnpm-debug.log*
coverage
.nyc_output
.vscode
.idea
*.md

• Dependency manifests are copied before source code, and BuildKit caches pnpm’s store to speed up repeat builds without weakening lockfile reproducibility.
• Build tooling stays in intermediate stages; the final Debian slim image contains only production dependencies, compiled output, ffmpeg, and curl for health checks.
• The API runs as an unprivileged user, exposes port 3000, and uses /health; adjust the output path, entry point, or health endpoint if the application differs.