Dockerfile.web

# Multi-stage build for pgEdge Postgres MCP Web Client
# Stage 1: Build the Vue.js application
FROM registry.access.redhat.com/ubi9/nodejs-24:latest AS builder

# Set working directory
WORKDIR /workspace

# Copy package files
COPY web/package*.json ./

# Install dependencies
RUN npm ci

# Copy source code
COPY web/ ./

# Build the application
RUN npm run build

# Stage 2: Serve with nginx
FROM registry.access.redhat.com/ubi9/nginx-126:latest

# Add labels for container metadata
LABEL name="pgedge-nla-web" \
      vendor="pgEdge" \
      version="1.0" \
      summary="pgEdge Natural Language Agent Web Client" \
      description="Web-based chat interface for pgEdge Natural Language Agent" \
      io.naturallanguageagent.web.name="io.github.pgEdge/nla-web"

# Apply available security patches
# Cache-bust: CACHE_DATE forces re-execution of dnf update on each CI build
ARG CACHE_DATE
USER root
# Restore /var/log/nginx ownership after dnf update: the upstream nginx
# RPM resets it to root:root 0711, which breaks nginx running as uid 1001.
RUN dnf update -y && dnf clean all \
    && chown -R 1001:0 /var/log/nginx \
    && chmod -R g+w /var/log/nginx

# Remove packages this image never uses at runtime: nginx-all-modules
# pulls in the image-filter, perl, xslt, mail and stream nginx
# modules, none of which docker/nginx.conf loads or references (it
# only uses the plain http block); vim/gdb/rsync/tar are
# interactive/admin tooling with no runtime role in a static file
# server. Each of these carries a large, largely unfixed CVE backlog
# in RHEL's packaging (vim alone accounts for 260+ findings), so
# removing them shrinks the actual attack surface rather than just
# suppressing scan noise. python3 is deliberately left in place: dnf
# and yum are RHEL-protected packages that depend on it, so removing
# it means bypassing dnf's own protection mechanism, a meaningfully
# bigger risk for a smaller win; it gets a trivyignore entry instead.
RUN dnf remove -y nginx-all-modules vim-minimal vim-filesystem \
      gdb-gdbserver rsync tar && dnf clean all
USER 1001

# Copy built application from builder
COPY --from=builder /workspace/dist /opt/app-root/src

# Copy nginx configuration with proper permissions
COPY --chmod=644 docker/nginx.conf /etc/nginx/nginx.conf

# Expose HTTP port
EXPOSE 8081

# nginx runs as user 1001 by default in UBI
USER 1001

# Start nginx
CMD ["nginx", "-g", "daemon off;"]