Docker

# Git / editor
.git
.github
.vscode
.idea

# local dependencies and outputs
**/node_modules
**/.next
**/dist
**/coverage
**/playwright-report
**/test-results

# secrets / local config
.env
.env.*
!.env.example

# misc

# TaskFlow Docker Snapshot

This is a teaching/reference snapshot for Phase 32. Adapt paths to the exact final repository layout before production use.

Production architecture keeps managed Supabase services external. `compose.yaml` uses local PostgreSQL only to demonstrate a repeatable local integration topology.

# Official sources used for Phase 32

- Docker multi-stage builds: https://docs.docker.com/build/building/multi-stage/
- Docker build best practices: https://docs.docker.com/build/building/best-practices/
- Docker build cache: https://docs.docker.com/build/cache/optimize/
- Docker Compose startup/readiness: https://docs.docker.com/compose/how-tos/startup-order/
- Next.js standalone output: https://nextjs.org/docs/app/api-reference/config/next-config-js/output

# Phase 32 version line

- Node runtime image: Node 24 LTS line (`node:24-bookworm-slim`)
- pnpm: 12.3.4 (course lock)
- PostgreSQL local integration image: 18-alpine
- Next.js: existing course lock (16.x) with `output: "standalone"`
- NestJS: existing course lock (12.x)
- Prisma: hard lock 7.9.1

Docker Desktop / Engine / Compose are environment tools rather than npm dependencies. Validate current stable releases on the machine used for the course.

# syntax=docker/dockerfile:1.7
FROM node:24-bookworm-slim AS base
ENV PNPM_HOME=/pnpm
ENV PATH=$PNPM_HOME:$PATH
RUN corepack enable && corepack prepare pnpm@12.3.4 --activate
WORKDIR /workspace

FROM base AS deps
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml turbo.json ./
COPY apps/api/package.json apps/api/package.json
COPY packages packages
RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
    pnpm install --frozen-lockfile

FROM deps AS builder
COPY . .
RUN pnpm --filter api exec prisma generate
RUN pnpm --filter api build
RUN pnpm --filter api deploy --prod /out/api

# syntax=docker/dockerfile:1.7
FROM node:24-bookworm-slim AS base
ENV PNPM_HOME=/pnpm
ENV PATH=$PNPM_HOME:$PATH
RUN corepack enable && corepack prepare pnpm@12.3.4 --activate
WORKDIR /workspace

FROM base AS deps
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml turbo.json ./
COPY apps/web/package.json apps/web/package.json
COPY packages packages
RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
    pnpm install --frozen-lockfile

FROM deps AS builder
COPY . .
ENV NEXT_TELEMETRY_DISABLED=1
RUN pnpm --filter web build

FROM node:24-bookworm-slim AS runner

import path from "node:path";
import type { NextConfig } from "next";

const nextConfig: NextConfig = {
  output: "standalone",
  outputFileTracingRoot: path.join(__dirname, "../.."),
};

export default nextConfig;

name: taskflow

services:
  db:
    image: postgres:18-alpine
    environment:
      POSTGRES_DB: taskflow
      POSTGRES_USER: taskflow
      POSTGRES_PASSWORD: taskflow_local_only
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U taskflow -d taskflow"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 10s
    volumes:
      - taskflow-db:/var/lib/postgresql/data

  api:
    build:

# Migration runbook

Production rule: run `prisma migrate deploy` once as an explicit deployment/release step before new API replicas begin serving traffic. Do not run it independently in every replica startup command.

Local example from the repository root:

```powershell
pnpm --filter api exec prisma migrate deploy
```

For a fully containerized local workflow, build a dedicated migration target/job that includes Prisma CLI and the schema, waits for PostgreSQL readiness, runs once, and exits successfully.

# Phase 32 verification matrix

- [ ] `docker build` succeeds for web with the committed lockfile.
- [ ] `docker build` succeeds for api with the committed lockfile.
- [ ] Runtime processes run as non-root users.
- [ ] Production images do not contain `.env`, `.git`, local `node_modules`, or source test output.
- [ ] Web container serves the production Next.js build on port 3000.
- [ ] API container serves `/health/live` on port 3001.
- [ ] API readiness fails when PostgreSQL is unavailable and recovers when PostgreSQL is ready.
- [ ] `docker compose up` uses `db` service DNS instead of localhost for API database access.
- [ ] Database state survives recreation of the db container when the named volume remains.
- [ ] SIGTERM produces a graceful NestJS shutdown.
- [ ] Rebuilding after a source-only change reuses dependency-install cache.
- [ ] Secrets are injected at runtime and not visible in image history.