Dockerfile.docs

# ── Stage 1: build the Vite docs app ─────────────────────────────────────────
FROM node:22-alpine AS builder
WORKDIR /repo

# The docs package has a local dependency on the root npm wrapper. Copy only
# that published wrapper plus locked documentation dependencies before source.
COPY package.json index.js install.js README.md LICENSE ./
COPY docs/package.json docs/package-lock.json ./docs/

# Install docs deps without executing package lifecycle scripts. The production
# image serves static files only and deliberately contains no compiler binary.
WORKDIR /repo/docs
RUN npm ci --ignore-scripts
COPY docs/ ./
RUN npm run build

# ── Stage 2: static-only production runtime ──────────────────────────────────
FROM node:22-alpine AS runtime

ARG ZIGCSS_VERSION=0.6.0-rc.2
LABEL org.opencontainers.image.title="ZigCSS Documentation" \
      org.opencontainers.image.version="${ZIGCSS_VERSION}" \
      org.opencontainers.image.source="https://github.com/vyakymenko/zigcss"

WORKDIR /app

# Copy only the files needed by the static server. They remain root-owned and
# read-only to the unprivileged runtime account.
COPY --from=builder /repo/docs/dist ./dist
COPY --from=builder /repo/docs/server.js ./server.js

ENV NODE_ENV=production
ENV PORT=8080
EXPOSE 8080

USER node
CMD ["node", "server.js"]