uj-mastering-master/Dockerfile

# uj-mastering-master — web UI
#
# The web UI is a static site: decoding and every metric run in the visitor's
# browser (web/dsp.js inside a Web Worker). This image only serves files — no
# application server, no upload endpoint, nothing written anywhere — so it runs
# read-only as nginx's unprivileged user. See deploy/nginx.conf for the CSP that
# stops the page from making network requests at all.
#
# The desktop app (PyQt5) is unaffected and not part of this image.

# ---- assets: version every file except the page by content ------------------
# Everything but index.html goes under v/<hash of the assets>/, and index.html's
# references are rewritten to match. Each deploy therefore changes every asset
# URL, so no cache (browser or Cloudflare, which forces .js/.css browser caching
# to 4 h) can pair a new index.html with an old app.js. Module imports and the
# worker URL are relative, so they resolve inside the versioned directory as is.
FROM alpine:3.22 AS assets
COPY web/ /src/
RUN set -eu; \
    cd /src; \
    v="$(find . -type f ! -name index.html | sort | xargs sha256sum | sha256sum | cut -c1-12)"; \
    mkdir -p "/out/v/$v"; \
    for f in *; do [ "$f" = index.html ] || cp -R "$f" "/out/v/$v/"; done; \
    sed -E "s#(href|src)=\"(app\.css|app\.js|vendor/[^\"]+)\"#\1=\"v/$v/\2\"#g" index.html > /out/index.html; \
    grep -q "src=\"v/$v/app.js\"" /out/index.html; \
    grep -q "href=\"v/$v/app.css\"" /out/index.html

# ---- runtime -------------------------------------------------------------------
FROM nginxinc/nginx-unprivileged:stable-alpine

COPY deploy/nginx.conf /etc/nginx/conf.d/default.conf
COPY deploy/security-headers.conf /etc/nginx/snippets/ujm-security-headers.conf
COPY --from=assets /out/ /usr/share/nginx/html/

EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD wget -q -O /dev/null http://127.0.0.1:8080/ || exit 1