Initial Commit

Dockerfile

@@ -0,0 +1,23 @@
+FROM oven/bun:1.3.14 AS build
+WORKDIR /app
+COPY package.json bun.lock ./
+# Infisical is a host-side operator tool; its binary installer is unnecessary in the image.
+RUN bun install --frozen-lockfile --ignore-scripts
+COPY . .
+RUN bun run build
+
+FROM oven/bun:1.3.14 AS runtime
+# Production reference imports stream XZ through the OS decoder; no archive extraction shell.
+RUN apt-get update && apt-get install -y --no-install-recommends xz-utils && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+ENV NODE_ENV=production HOST=0.0.0.0 PORT=3000
+COPY --from=build /app/package.json /app/bun.lock ./
+RUN bun install --frozen-lockfile --production
+COPY --from=build /app/build ./build
+COPY --from=build /app/src/lib ./src/lib
+COPY --from=build /app/workers ./workers
+COPY --from=build /app/fixtures ./fixtures
+RUN mkdir -p /app/data/reference && chown -R bun:bun /app/data
+USER bun
+EXPOSE 3000
+CMD ["bun", "build/index.js"]