18F/identity-idp

# Use build to install our required Gems
FROM logindotgov/build as build
 
# Everything happens here from now on
WORKDIR /idp
 
# Prod Gems
COPY Gemfile Gemfile.lock ./
RUN bundle install --deployment --clean --without development test
 
# Prod NPM packages
COPY package.json yarn.lock ./
RUN NODE_ENV=production yarn install --force \
    && yarn cache clean
 
# Switch to base image
FROM logindotgov/base
WORKDIR /idp
 
# Copy Gems, NPMs, and other relevant items from build layer
COPY --chown=appuser:appuser --from=build /idp .
 
# Copy in whole source (minus items matched in .dockerignore)
COPY --chown=appuser:appuser . .
COPY --chown=appuser:appuser --from=build /usr/local/bundle/config /usr/local/bundle
RUN mkdir -p /idp/log /usr/local/share/aws ; chown appuser /idp/log
 
# update CA certs so that we can trust RDS
RUN curl https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem > /usr/local/share/aws/rds-combined-ca-bundle.pem && grep 'END CERTIFICATE' /usr/local/share/aws/rds-combined-ca-bundle.pem >/dev/null
 
# Up to this point we've been root, change to a lower priv. user
USER appuser
 
EXPOSE 3000
CMD ["bundle", "exec", "rackup", "config.ru", "--host", "0.0.0.0", "--port", "3000"]