@dockerforge/core 0.1.1 → 0.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dockerforge/core",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "DockerForge engine: analyse a local project and generate production-grade Dockerfiles, .dockerignore, and Compose, and lint Dockerfiles. Offline, no network.",
   "license": "Apache-2.0",
   "author": "Docker Forge",

package/src/engine/analysis/analyser.js

@@ -707,6 +707,36 @@ async function analyseNode(projectPath, files, hints, projectRootPath = null, is
   // Role
   const role = await detectRole(projectPath, pkg);
 
+  // Detect which conventional source directories actually exist on disk, so the
+  // generator copies real directories instead of guessing the layout (e.g. app/ vs src/).
+  const SOURCE_DIR_CANDIDATES = [
+    'src', 'app', 'pages', 'components', 'lib', 'styles',
+    'public', 'server', 'config', 'content', 'i18n', 'locales', 'hooks', 'utils',
+  ];
+  const sourceDirs = [];
+  for (const d of SOURCE_DIR_CANDIDATES) {
+    try { if ((await fs.stat(path.join(projectPath, d))).isDirectory()) sourceDirs.push(d); }
+    catch { /* absent */ }
+  }
+
+  // Detect framework build/runtime config files that exist, so we copy real filenames
+  // instead of guessing a single hard-coded one. Next.js also reads its config at runtime.
+  const FRAMEWORK_CONFIG_CANDIDATES = [
+    'next.config.js', 'next.config.mjs', 'next.config.cjs', 'next.config.ts',
+    'tailwind.config.js', 'tailwind.config.ts', 'tailwind.config.cjs', 'tailwind.config.mjs',
+    'components.json', 'jsconfig.json',
+    'remix.config.js', 'svelte.config.js', 'nuxt.config.ts', 'nuxt.config.js',
+  ];
+  const frameworkConfigFiles = [];
+  for (const f of FRAMEWORK_CONFIG_CANDIDATES) {
+    try { if ((await fs.stat(path.join(projectPath, f))).isFile()) frameworkConfigFiles.push(f); }
+    catch { /* absent */ }
+  }
+  // The config Next.js reads on `next start` (first match wins) — must be in the runtime image.
+  const nextRuntimeConfig = framework === 'nextjs'
+    ? (frameworkConfigFiles.find(f => f.startsWith('next.config.')) || null)
+    : null;
+
   // Detect sibling directories referenced via require('../xxx') in the entry point.
   // These are root-level dirs that sit alongside the service dir and must be COPYed
   // into the image so cross-directory requires resolve at runtime.
@@ -731,6 +761,9 @@ async function analyseNode(projectPath, files, hints, projectRootPath = null, is
     rootBuildDeps,   // root-level dirs imported by vite config via '../dirname' — must be copied before build
     hasScopedPackages,
     siblingDeps,     // root-level dirs referenced via require('../xxx') — must be COPYed into runtime image
+    sourceDirs,           // conventional source dirs that actually exist on disk (real, not guessed)
+    frameworkConfigFiles, // framework build/runtime config files present (next.config, tailwind.config, ...)
+    nextRuntimeConfig,    // the next.config.* file Next.js reads at runtime, or null
     assumptions,
   };
 }

package/src/engine/generation/generator.js

@@ -6,8 +6,12 @@ const path = require('path');
 const { STACKS, BASE_IMAGES } = require('../constants');
 const { isSecretLikeEnvKey, isSecretLikeEnvValue } = require('../security/security');
 
-const STATIC_RUNTIME_IMAGE = 'nginx:1.27-alpine';
 const PNPM_VERSION = '9';
+const STATIC_SERVER_PACKAGE = 'serve@14.2.4';
+
+// Frameworks that produce a long-running Node server (SSR, API routes, dynamic rendering).
+// These run with `next start` / a framework server instead of a generic static file server.
+const SERVER_RENDERED_FRAMEWORKS = new Set(['nextjs', 'remix', 'sveltekit', 'nuxt']);
 
 function installPnpmGlobalCmd() {
   return `npm install -g pnpm@${PNPM_VERSION}`;
@@ -32,39 +36,20 @@ function runtimeStartCmd(a) {
   return ['node', `${buildOut}/${entry.replace(/^\.\//, '')}`];
 }
 
-function nginxStaticServerBlock(port) {
-  return 'COPY nginx.conf /etc/nginx/conf.d/default.conf';
-}
+function staticServeRuntimeStage(baseImage, port, buildAssetCopyLine, outputDir) {
+  return `FROM ${baseImage}
 
-function nginxConf(port) {
-  return `server {
-    listen ${port};
-    root /usr/share/nginx/html;
-    index index.html;
+WORKDIR /app
 
-    add_header X-Frame-Options "SAMEORIGIN";
-    add_header X-Content-Type-Options "nosniff";
-    add_header Referrer-Policy "strict-origin-when-cross-origin";
+ENV NODE_ENV=production
 
-    location ~* \\.(js|css|png|jpg|jpeg|gif|ico|svg|woff2)$ {
-        expires 1y;
-        add_header Cache-Control "public, immutable";
-    }
+RUN npm install -g ${STATIC_SERVER_PACKAGE} && npm cache clean --force
+${buildAssetCopyLine}
+USER node
 
-    location /health { return 200 "ok"; add_header Content-Type text/plain; }
-    location / { try_files $uri $uri/ /index.html; }
-
-    gzip on;
-    gzip_types text/plain text/css application/json application/javascript
-               text/xml application/xml image/svg+xml font/woff2 application/manifest+json;
-}`.trim();
-}
-
-function nginxNonRootPrepBlock() {
-  return [
-    'RUN mkdir -p /var/cache/nginx/client_temp /var/cache/nginx/proxy_temp /var/cache/nginx/fastcgi_temp /var/cache/nginx/uwsgi_temp /var/cache/nginx/scgi_temp',
-    'RUN touch /var/run/nginx.pid && chown -R nginx:nginx /var/cache/nginx /var/run/nginx.pid /var/log/nginx /etc/nginx/conf.d /usr/share/nginx/html',
-  ].join('\n');
+EXPOSE ${port}
+${simpleHttpHealthcheck(port)}
+CMD ["serve", "-s", "${outputDir}", "-l", "${port}"]`;
 }
 
 function simpleHttpHealthcheck(port) {
@@ -189,6 +174,22 @@ function nodeSourceCopyBlock(a, configCopyLine = '', frontendAssetCopyLine = '')
   return blocks.join('\n');
 }
 
+// Build-stage source copy for Next.js. Copies the config files and source directories that
+// actually exist on disk (detected by the analyser) instead of guessing app/ vs src/.
+function nextSourceCopyBlock(a, rootConfigFiles = []) {
+  const lines = [];
+  const configFiles = [...new Set([
+    ...rootConfigFiles.filter(f => !['package.json', a.lockFile].includes(f)),
+    ...(a.frameworkConfigFiles || []),
+  ])];
+  if (configFiles.length > 0) lines.push(`COPY ${configFiles.join(' ')} ./`);
+  const dirs = (Array.isArray(a.sourceDirs) && a.sourceDirs.length > 0)
+    ? a.sourceDirs
+    : ['app', 'pages', 'components', 'public']; // fallback only if nothing was detected
+  for (const d of dirs) lines.push(`COPY ${d}/ ./${d}/`);
+  return lines.join('\n');
+}
+
 function pythonBuilderImage(a) {
   return a.hasNativeDeps ? `python:${a.version}` : BASE_IMAGES[STACKS.PYTHON](a.version);
 }
@@ -273,6 +274,9 @@ function buildEnvBlock(envVars) {
 }
 
 function buildCommandPrefix(service) {
+  // Server-rendered frameworks (Next.js, Remix, ...) run their own build; the CRA-specific
+  // env prefix (DISABLE_ESLINT_PLUGIN etc.) does not apply and just adds noise.
+  if (SERVER_RENDERED_FRAMEWORKS.has(service.framework)) return '';
   // Fire for CRA regardless of how detection landed — framework='cra', role='frontend',
   // or any build command that invokes react-scripts directly.
   const isReactScripts =
@@ -668,8 +672,7 @@ ENTRYPOINT ["dotnet", "${be.projectName}.dll"]`.trim());
   }
   improvements.push('HEALTHCHECK should probe /health for each runtime service; add a /health endpoint returning 2xx where missing');
 
-  const collectedNginxConf = frontends.length > 0 ? nginxConf(frontends[0].port) : undefined;
-  return { dockerfile, dockerignore, improvements, nginxConf: collectedNginxConf };
+  return { dockerfile, dockerignore, improvements };
 }
 
 // ── Node at root (original behaviour) ───────────────────────────────────────
@@ -690,10 +693,28 @@ function generateNodeRoot(a, envVars = [], rootConfigFiles = []) {
     const buildOut = a.buildOutputDir || 'dist';
     const sourceCopyBlock = nodeSourceCopyBlock(a, configCopyLine, frontendAssetCopyLine);
 
-    // CRA / pure-frontend: runtime is a static file server, not a Node app.
-    // react-scripts is a devDep — it won't be present after --production install,
-    // and react-scripts start is a dev server anyway.
-    if (a.role === 'frontend' || a.framework === 'cra') {
+    // Next.js (and other SSR frameworks): a Node server, NOT a static site.
+    // Build with `next build`, then run `next start` on a lean Node runtime. Serving the
+    // .next output via a generic static server would break SSR, API routes, and dynamic rendering.
+    if (a.framework === 'nextjs') {
+      const nextSrcCopy = nextSourceCopyBlock(a, rootConfigFiles);
+      const hasPublic = Array.isArray(a.sourceDirs) && a.sourceDirs.includes('public');
+      const publicCopy = hasPublic ? `COPY --from=builder /app/public ./public\n` : '';
+      const runtimeConfigCopy = a.nextRuntimeConfig
+        ? `COPY --from=builder /app/${a.nextRuntimeConfig} ./${a.nextRuntimeConfig}\n`
+        : '';
+      // Prune dev deps to production IN THE BUILDER, then copy node_modules into the runtime
+      // stage. This avoids a second install at runtime — which would re-hit the registry (and,
+      // for private/scoped packages, need the npmrc secret a second time). The builder already
+      // fetched and authenticated everything; pruning just drops the dev-only packages.
+      const secretMount = a.hasScopedPackages ? '--mount=type=secret,id=npmrc,target=/root/.npmrc ' : '';
+      const prodPrune =
+        a.packageManager === 'pnpm' ? 'RUN pnpm prune --prod'
+        : a.packageManager === 'yarn' ? `RUN ${secretMount}yarn install --frozen-lockfile --production --ignore-scripts && yarn cache clean`
+        : 'RUN npm prune --omit=dev';
+      // node images ship npm + yarn, but not pnpm — install it in the runtime stage if needed.
+      const runtimePmSetup = a.packageManager === 'pnpm' ? `RUN ${installPnpmGlobalCmd()}\n` : '';
+
       dockerfile = `
 # ─── Stage 1: Build ───────────────────────────────────────
 ${builderFrom(baseImage, 'builder')}
@@ -703,23 +724,68 @@ WORKDIR /app
 COPY ${a.lockFile} package.json ./
 ${buildInstall}
 
-# Copy source
-${sourceCopyBlock}
+# Copy source and build-time config
+${nextSrcCopy}
 RUN ${buildPrefix}${a.buildCommand}
 
+# Drop dev dependencies so only production node_modules carry into the runtime image
+${prodPrune}
+
 # ─── Stage 2: Runtime ─────────────────────────────────────
-FROM ${STATIC_RUNTIME_IMAGE}
+FROM ${baseImage}
 
-COPY --from=builder /app/${buildOut} /usr/share/nginx/html
-${nginxStaticServerBlock(a.port)}
+WORKDIR /app
+
+${buildEnvBlock(envVars)}
+
+# Next.js runs as a Node server. Copy production deps + build output from the builder —
+# no second install here, so the (often private) registry is only contacted once, in the builder.
+${runtimePmSetup}COPY --from=builder /app/package.json ./package.json
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/${buildOut} ./${buildOut}
+${publicCopy}${runtimeConfigCopy}${runtimeUserBlock(true)}
 
+${nodeStopSignalBlock()}
 EXPOSE ${a.port}
 ${simpleHttpHealthcheck(a.port)}
-CMD ["nginx", "-g", "daemon off;"]`.trim();
+CMD ${startCmdJson}`.trim();
+
+      improvements.push('Next.js is built and run as a Node server (next start) so SSR and API routes work — a generic static server image would break them.');
+      improvements.push('Production node_modules are copied from the build stage (deps fetched once). For an even smaller image, set `output: "standalone"` in next.config and copy .next/standalone + .next/static.');
+      improvements.push('Only known framework config files are auto-copied — verify any project-specific build config is also COPYed (e.g. sentry.*.config.ts, next-i18next.config).');
+      if (a.hasScopedPackages) {
+        improvements.push('Scoped packages detected (may include a private registry): the install keeps a secret mount — build with `docker build --secret id=npmrc,src=.npmrc .` and a .npmrc that authenticates your scope.');
+      }
+      improvements.push('HEALTHCHECK probes /health, which Next.js does not expose by default — add a health route or point the healthcheck at an existing path.');
+      return { dockerfile, dockerignore: nodeDockerignore(), improvements };
+    }
+
+    // CRA / pure-frontend SPA: runtime is a static file server, not a Node app.
+    // react-scripts is a devDep — it won't be present after --production install,
+    // and react-scripts start is a dev server anyway. Server-rendered frameworks are
+    // explicitly excluded so they never get the static-file-server treatment.
+    const isStaticSpa = (a.role === 'frontend' || a.framework === 'cra')
+      && !SERVER_RENDERED_FRAMEWORKS.has(a.framework);
+    if (isStaticSpa) {
+      dockerfile = `
+# ─── Stage 1: Build ───────────────────────────────────────
+${builderFrom(baseImage, 'builder')}
+
+WORKDIR /app
+
+COPY ${a.lockFile} package.json ./
+${buildInstall}
+
+# Copy source
+${sourceCopyBlock}
+RUN ${buildPrefix}${a.buildCommand}
+
+# ─── Stage 2: Runtime ─────────────────────────────────────
+${staticServeRuntimeStage(baseImage, a.port, `COPY --from=builder /app/${buildOut} ./${buildOut}`, buildOut)}`.trim();
 
       const validationDockerfile = dockerfile;
-      improvements.push(`Frontend-only: built then served with ${STATIC_RUNTIME_IMAGE}. No Node runtime or node_modules in final image.`);
-      return withValidationVariant({ dockerfile, dockerignore: nodeDockerignore(), nginxConf: nginxConf(a.port), improvements }, validationDockerfile);
+      improvements.push(`Frontend-only: built then served with ${STATIC_SERVER_PACKAGE} as the non-root node user.`);
+      return withValidationVariant({ dockerfile, dockerignore: nodeDockerignore(), improvements }, validationDockerfile);
 
     } else {
       const pruneCmd = nodePruneLine(a.packageManager);
@@ -807,8 +873,9 @@ function generateNodeSub(a, dir, sharedDirs, staticAssets = [], rootConfigFiles
 
   let dockerfile;
 
-  if (a.hasBuild && a.role === 'frontend') {
-    // Frontend build → serve static via nginx
+  if (a.hasBuild && a.role === 'frontend' && !SERVER_RENDERED_FRAMEWORKS.has(a.framework)) {
+    // Static SPA build → serve the compiled output. Server-rendered frameworks (Next.js, Remix, ...)
+    // are excluded here and fall through to the Node-server runtime branch below.
     const stageName = 'build';
 
     // When lock file is at project root, copy root files + service package.json and
@@ -883,18 +950,11 @@ ${sourceCopy}
 ${sharedConfigCopy}${buildRun}
 
 # ─── Stage 2: Serve ───────────────────────────────────────
-FROM ${STATIC_RUNTIME_IMAGE}
-
-COPY --from=${stageName} ${buildOutput} /usr/share/nginx/html
-${nginxStaticServerBlock(a.port)}
-
-EXPOSE ${a.port}
-${simpleHttpHealthcheck(a.port)}
-CMD ["nginx", "-g", "daemon off;"]`.trim();
+${staticServeRuntimeStage(baseImage, a.port, `COPY --from=${stageName} ${buildOutput} ./${a.buildOutputDir || 'build'}`, a.buildOutputDir || 'build')}`.trim();
 
     const validationDockerfile = dockerfile;
-    improvements.push(`Frontend-only: built then served with ${STATIC_RUNTIME_IMAGE}. If a backend also serves the files, merge into one multi-service build.`);
-    return withValidationVariant({ dockerfile, dockerignore: nodeDockerignore(), nginxConf: nginxConf(a.port), improvements }, validationDockerfile);
+    improvements.push(`Frontend-only: built then served with ${STATIC_SERVER_PACKAGE} as the non-root node user. If a backend also serves the files, merge into one multi-service build.`);
+    return withValidationVariant({ dockerfile, dockerignore: nodeDockerignore(), improvements }, validationDockerfile);
 
 
   } else {

package/src/engine/index.js

@@ -132,19 +132,17 @@ function applyValidationEvidence(confidenceResult, validation) {
 
 /**
  * Strip BuildKit-specific features from a Dockerfile to produce the simple default output.
- * The full version (with mounts, CRA flags, etc.) becomes powerDockerfile.
+ * Build environment prefixes stay in both outputs because they are part of the recipe.
  */
 function toSimpleDockerfile(dockerfile) {
   return dockerfile.split('\n').map(line => {
     const isRun = /^RUN\s/.test(line);
     if (!isRun) return line;
-    // Strip --mount=type=cache,... and --mount=type=secret,...
-    line = line.replace(/--mount=type=\w+,\S+\s+/g, '');
-    // Strip CRA build environment prefix (CI=false GENERATE_SOURCEMAP=false ...)
-    line = line.replace(
-      /^(RUN\s+)CI=false GENERATE_SOURCEMAP=false NODE_OPTIONS=--max-old-space-size=\d+ DISABLE_ESLINT_PLUGIN=true\s+/,
-      '$1'
-    );
+    // Strip only --mount=type=cache,... (a pure build-speed optimisation).
+    // KEEP --mount=type=secret,... — for private/scoped registries it's the only way the
+    // default Dockerfile can authenticate (e.g. `docker build --secret id=npmrc,src=.npmrc`).
+    // An unsupplied secret mount is a no-op, so this is safe even when no secret is passed.
+    line = line.replace(/--mount=type=cache,\S+\s+/g, '');
     return line;
   }).join('\n');
 }