# Build on your workstation/CI, not the 1 GB production server.
# Supply a tested node:22-bookworm-slim@sha256:... for reproducible rebuilds.
ARG NODE_IMAGE=node:22-bookworm-slim
FROM ${NODE_IMAGE}
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev --ignore-scripts && npm cache clean --force
COPY index.html favicon.svg LICENSE CONTRIBUTING.md THIRD_PARTY_NOTICES.md ./
COPY css ./css
COPY js ./js
COPY vendor ./vendor
# Atomic research exports may have mode 0600; the serving user must own them.
COPY --chown=node:node content ./content
COPY scripts ./scripts
RUN mkdir -p /app/.state /var/lib/axiom && chown node:node /app/.state /var/lib/axiom
ENV NODE_ENV=production HOST=0.0.0.0 PORT=8000 PAPER_WORKER=0
USER node
EXPOSE 8000
CMD ["node", "--max-old-space-size=160", "scripts/serve.js"]
