newblaccandClaude Sonnet 4.6
5539235004
- Add security.ts: helmet, CORS allowlist, timing-safe API key auth, prototype pollution guard, Mermaid input limits, rate limiting (general/destructive/burst) - WS auth challenge-response with 5 s timeout and close code 4001 - Fix sync crash: array check before logger access (500 → 400) - Fix sync/v2: validate element type before write (invalid → 400) - Upgrade zod 3.22.4 → 3.25.5 (fixes ERR_PACKAGE_PATH_NOT_EXPORTED on startup) - Extract ElementSharedFieldsSchema; move VALID_ELEMENT_TYPES to module level - Docker: resource limits, .dockerignore hardening - Add .project-hooks/pre-commit; expand test coverage (369 tests) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
67 lines
2.0 KiB
Docker
67 lines
2.0 KiB
Docker
# Dockerfile for Canvas Server (Optional)
|
|
# Provides the web interface, REST API, and SQLite persistence
|
|
|
|
# Stage 1: Build frontend
|
|
FROM node:20-slim AS frontend-builder
|
|
|
|
WORKDIR /app
|
|
|
|
COPY package*.json ./
|
|
RUN --mount=type=cache,target=/root/.npm npm ci --ignore-scripts
|
|
|
|
COPY frontend ./frontend
|
|
COPY vite.config.js ./
|
|
RUN npm run build:frontend
|
|
|
|
# Stage 2: Build backend (TypeScript compilation + native modules)
|
|
FROM node:20-slim AS backend-builder
|
|
|
|
RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /app
|
|
|
|
COPY package*.json ./
|
|
RUN --mount=type=cache,target=/root/.npm npm ci
|
|
|
|
COPY src ./src
|
|
COPY tsconfig.json ./
|
|
RUN npm run build:server
|
|
|
|
# Stage 3: Production Canvas Server
|
|
FROM node:20-slim AS production
|
|
|
|
RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN addgroup --system --gid 1001 nodejs && \
|
|
adduser --system --uid 1001 --gid 1001 nodejs
|
|
|
|
WORKDIR /app
|
|
|
|
COPY package*.json ./
|
|
RUN --mount=type=cache,target=/root/.npm npm ci --omit=dev
|
|
|
|
# Remove build tools after native modules are compiled
|
|
RUN apt-get purge -y python3 make g++ && apt-get autoremove -y
|
|
|
|
COPY --from=backend-builder /app/dist ./dist
|
|
COPY --from=frontend-builder /app/dist/frontend ./dist/frontend
|
|
|
|
RUN mkdir -p /app/data && chown -R nodejs:nodejs /app
|
|
USER nodejs
|
|
|
|
ENV NODE_ENV=production
|
|
ENV PORT=3000
|
|
# HOST=0.0.0.0 is correct inside Docker: the container binds all interfaces,
|
|
# but external access is gated by the published port mapping in docker-compose.yml.
|
|
# For local dev without Docker, the server defaults to localhost (127.0.0.1).
|
|
ENV HOST=0.0.0.0
|
|
ENV EXCALIDRAW_DB_PATH=/app/data/excalidraw.db
|
|
|
|
EXPOSE 3000
|
|
|
|
CMD ["node", "dist/server.js"]
|
|
|
|
LABEL org.opencontainers.image.source="https://github.com/sanjibdevnathlabs/mcp-excalidraw-local"
|
|
LABEL org.opencontainers.image.description="MCP Excalidraw Canvas Server - Web UI and REST API (with SQLite persistence & multi-tenancy)"
|
|
LABEL org.opencontainers.image.licenses="MIT"
|