Dockerfile

# Multi-stage build for the standalone static demo.
# Build:  docker build -t cwl-editor-demo .
# Run:    docker run --rm -p 8080:8080 cwl-editor-demo  ->  http://localhost:8080
FROM node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2 AS build
WORKDIR /app
RUN corepack enable
# pnpm-workspace.yaml carries the security overrides, so it must be present for
# the frozen install to resolve consistently with the committed lockfile.
COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml ./
RUN pnpm install --frozen-lockfile
COPY . .
RUN pnpm build:demo

FROM nginx:1.27-alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10 AS runtime
# Serve as the image's built-in unprivileged `nginx` user on an unprivileged
# port so the container never runs as root (satisfies trivy DS-0002).
COPY --from=build --chown=nginx:nginx /app/dist-demo /usr/share/nginx/html
RUN sed -i 's/listen       80;/listen       8080;/' /etc/nginx/conf.d/default.conf \
    && chown -R nginx:nginx /usr/share/nginx/html /var/cache/nginx /var/run /var/log/nginx
USER nginx
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 CMD wget -qO- http://127.0.0.1:8080/ >/dev/null || exit 1
CMD ["nginx", "-g", "daemon off;"]