mfeflow 0.5.0 → 0.7.0

package/assets/features/deploy-cloudflare/files/headers.remote

@@ -0,0 +1,14 @@
+# The shell's origin is filled in from deploy/cloudflare.json when the build is staged, so the shell can load
+# this remote with crossorigin. Each path matches one Cache-Control rule, because a header set by two rules is
+# joined with a comma. Hashed files under /static never change.
+/*
+  Access-Control-Allow-Origin: __SHELL_ORIGIN__
+  X-Content-Type-Options: nosniff
+/
+  Cache-Control: no-cache
+/index.html
+  Cache-Control: no-cache
+/mf-manifest.json
+  Cache-Control: no-cache
+/static/*
+  Cache-Control: public, max-age=31536000, immutable

package/assets/features/deploy-cloudflare/files/headers.shell.eta

@@ -0,0 +1,18 @@
+# Files that decide what is live are checked on every load. Hashed files never change, so they are cached
+# for a year. Each path matches one rule, because a header set by two rules is joined with a comma.
+/*
+  X-Content-Type-Options: nosniff
+  Referrer-Policy: strict-origin-when-cross-origin
+  X-Frame-Options: SAMEORIGIN
+/
+  Cache-Control: no-cache
+/index.html
+  Cache-Control: no-cache
+/mf-manifest.json
+  Cache-Control: no-cache
+/config/runtime-config*
+  Cache-Control: no-cache
+<% if (!it.options.r2Proxy) { %>/registry/*
+  Cache-Control: no-cache
+<% } %>/static/*
+  Cache-Control: public, max-age=31536000, immutable

package/assets/features/deploy-cloudflare/files/r2-cors.json

@@ -0,0 +1,10 @@
+{
+  "rules": [
+    {
+      "allowed": {
+        "origins": ["https://shop.example.com"],
+        "methods": ["GET"]
+      }
+    }
+  ]
+}

package/assets/features/deploy-cloudflare/files/registry-proxy.ts

@@ -0,0 +1,80 @@
+// Serves /registry/* from the REGISTRY R2 binding. `assets.run_worker_first` sends only those paths here.
+// _headers does not apply to responses a Worker makes, so the cache rules are set below.
+//   /registry/index.json                  ->  envs/<MFE_ENV>/index.json     checked on every load
+//   /registry/<name>/<version>/<file>     ->  <name>/<version>/<file>       never changes
+// The types below cover only what this file uses of the Cloudflare runtime.
+interface R2Object {
+  httpEtag: string;
+  body?: ReadableStream;
+  writeHttpMetadata(headers: Headers): void;
+}
+
+interface Env {
+  MFE_ENV: string;
+  REGISTRY: {
+    get(key: string, options?: { onlyIf?: Headers }): Promise<R2Object | null>;
+    head(key: string): Promise<R2Object | null>;
+  };
+}
+
+const INDEX_CACHE = 'no-cache';
+const VERSIONED_CACHE = 'public, max-age=31536000, immutable';
+
+const PREFIX = '/registry/';
+
+/** A plain response that also tells browsers not to guess the type. */
+function reply(
+  body: ReadableStream | string | null,
+  init: ResponseInit = {},
+  extra?: Headers,
+): Response {
+  const headers = new Headers(extra);
+  for (const [name, value] of new Headers(init.headers)) headers.set(name, value);
+  headers.set('X-Content-Type-Options', 'nosniff');
+  return new Response(body, { ...init, headers });
+}
+
+// The key is the decoded path. Anything that could climb out of /registry or into envs/ is not a key.
+function keyFor(pathname: string, env: Env): { key: string; cache: string } | undefined {
+  if (!pathname.startsWith(PREFIX)) return undefined;
+  const rest = decodeURIComponent(pathname.slice(PREFIX.length));
+  if (
+    rest.includes('\\') ||
+    rest.split('/').some((part) => part === '' || part === '.' || part === '..')
+  ) {
+    return undefined;
+  }
+  if (rest === 'index.json') return { key: `envs/${env.MFE_ENV}/index.json`, cache: INDEX_CACHE };
+  if (/^(?!envs\/)[^/]+\/[^/]+\/.+/.test(rest)) return { key: rest, cache: VERSIONED_CACHE };
+  return undefined;
+}
+
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    if (request.method !== 'GET' && request.method !== 'HEAD') {
+      return reply('Method not allowed', { status: 405, headers: { Allow: 'GET, HEAD' } });
+    }
+    let target: ReturnType<typeof keyFor>;
+    try {
+      target = keyFor(new URL(request.url).pathname, env);
+    } catch {
+      return reply('Bad request', { status: 400 });
+    }
+    if (target === undefined) return reply('Not found', { status: 404 });
+
+    const object =
+      request.method === 'HEAD'
+        ? await env.REGISTRY.head(target.key)
+        : await env.REGISTRY.get(target.key, { onlyIf: request.headers });
+    if (object === null) return reply('Not found', { status: 404 });
+
+    const headers = new Headers();
+    object.writeHttpMetadata(headers);
+    headers.set('etag', object.httpEtag);
+    headers.set('Cache-Control', target.cache);
+    if (request.method === 'HEAD') return reply(null, {}, headers);
+    // An object with no body means the If-None-Match or If-Modified-Since check matched.
+    if (object.body === undefined) return reply(null, { status: 304 }, headers);
+    return reply(object.body, {}, headers);
+  },
+};

package/assets/features/deploy-cloudflare/files/wrangler.remote.jsonc.eta

@@ -0,0 +1,21 @@
+{
+  "$schema": "../../node_modules/wrangler/config-schema.json",
+  // A remote as its own Worker with static assets. This file is yours: change names, add routes, drop an environment.
+  // Deploy with `pnpm deploy:cloudflare <staging|prod>`. Remotes have no fallback page, so a mistyped path is a
+  // 404 and not an HTML page where JavaScript was expected.
+  "name": "<%= it.scope.slice(1) %>-<%= it.app.name %>",
+  "compatibility_date": "2026-10-28",
+  "assets": { "directory": "./dist", "not_found_handling": "none" },
+  // The shell loads this remote from its own address, so give each environment a route or use its workers.dev name:
+  // "routes": [{ "pattern": "<%= it.app.name %>.shop.example.com", "custom_domain": true }]
+  "env": {
+    "staging": {
+      "name": "<%= it.scope.slice(1) %>-<%= it.app.name %>-staging",
+      "assets": { "directory": "./.mfeflow/cloudflare/staging", "not_found_handling": "none" },
+    },
+    "prod": {
+      "name": "<%= it.scope.slice(1) %>-<%= it.app.name %>-prod",
+      "assets": { "directory": "./.mfeflow/cloudflare/prod", "not_found_handling": "none" },
+    },
+  },
+}

package/assets/features/deploy-cloudflare/files/wrangler.shell.jsonc.eta

@@ -0,0 +1,40 @@
+{
+  "$schema": "../../node_modules/wrangler/config-schema.json",
+  // The shell as a Worker with static assets. This file is yours: change names, add routes, drop an environment.
+  // Deploy with `pnpm deploy:cloudflare <staging|prod>`. It stages the build with that environment's runtime
+  // config, then runs `wrangler deploy --env <name>`. A bare `wrangler deploy` would publish the top level.
+  "name": "<%= it.scope.slice(1) %>-<%= it.app.name %>",
+<% if (it.options.r2Proxy) { %>  "main": "worker/registry-proxy.ts",
+<% } %>  "compatibility_date": "2026-10-28",
+  // `wrangler dev` and the top level serve the build as is. The environments serve the staged copies.
+  "assets": {
+    "directory": "./dist",
+    "not_found_handling": "single-page-application",
+<% if (it.options.r2Proxy) { %>    "run_worker_first": ["/registry/*"],
+<% } %>  },
+<% if (it.options.r2Proxy) { %>  "vars": { "MFE_ENV": "dev" },
+  "r2_buckets": [{ "binding": "REGISTRY", "bucket_name": "<%= it.scope.slice(1) %>-registry-dev" }],
+<% } %>  // To serve a domain, add to each environment: "routes": [{ "pattern": "shop.example.com", "custom_domain": true }]
+  "env": {
+    "staging": {
+      "name": "<%= it.scope.slice(1) %>-<%= it.app.name %>-staging",
+      "assets": {
+        "directory": "./.mfeflow/cloudflare/staging",
+        "not_found_handling": "single-page-application",
+<% if (it.options.r2Proxy) { %>        "run_worker_first": ["/registry/*"],
+<% } %>      },
+<% if (it.options.r2Proxy) { %>      "vars": { "MFE_ENV": "staging" },
+      "r2_buckets": [{ "binding": "REGISTRY", "bucket_name": "<%= it.scope.slice(1) %>-registry-staging" }],
+<% } %>    },
+    "prod": {
+      "name": "<%= it.scope.slice(1) %>-<%= it.app.name %>-prod",
+      "assets": {
+        "directory": "./.mfeflow/cloudflare/prod",
+        "not_found_handling": "single-page-application",
+<% if (it.options.r2Proxy) { %>        "run_worker_first": ["/registry/*"],
+<% } %>      },
+<% if (it.options.r2Proxy) { %>      "vars": { "MFE_ENV": "prod" },
+      "r2_buckets": [{ "binding": "REGISTRY", "bucket_name": "<%= it.scope.slice(1) %>-registry-prod" }],
+<% } %>    },
+  },
+}

package/assets/features/deploy-docker/feature.json

@@ -0,0 +1,22 @@
+{
+  "name": "deploy-docker",
+  "version": "0.1.0",
+  "description": "Package the shell and each remote as a non-root nginx image: a Dockerfile with an APP build argument, nginx cache and CORS rules, a start script that picks the runtime config from MFE_ENV, a Kubernetes example, a compose file and a .dockerignore. Opt-in code you own; nothing in mfeflow calls it.",
+  "requires": ["core"],
+  "files": [
+    { "to": "docker/Dockerfile", "target": "root", "from": "files/Dockerfile" },
+    { "to": "docker/nginx.shell.conf", "target": "root", "from": "files/nginx.shell.conf" },
+    { "to": "docker/nginx.remote.conf", "target": "root", "from": "files/nginx.remote.conf" },
+    { "to": "docker/40-mfe-config.sh", "target": "root", "from": "files/40-mfe-config.sh" },
+    {
+      "to": "docker/compose-registry.json",
+      "target": "root",
+      "from": "files/compose-registry.json.eta",
+      "template": true
+    },
+    { "to": "compose.yaml", "target": "root", "from": "files/compose.yaml.eta", "template": true },
+    { "to": "k8s/mfe.yaml", "target": "root", "from": "files/k8s.yaml" },
+    { "to": ".dockerignore", "target": "root", "from": "files/dockerignore" },
+    { "to": "docs/docker.md", "target": "root", "from": "files/docker.md" }
+  ]
+}

package/assets/features/deploy-docker/files/40-mfe-config.sh

@@ -0,0 +1,76 @@
+#!/bin/sh
+# Runs before nginx starts (the base image runs everything in /docker-entrypoint.d, then execs
+# nginx). A non-zero exit stops the container, so a bad setting never serves the wrong config.
+#
+# Shell image: MFE_ENV picks /opt/mfe/configs/runtime-config.$MFE_ENV.json and it is copied to
+#   $MFE_RUNTIME_DIR/runtime-config.json. A runtime-config.json already in that folder (a mounted
+#   ConfigMap) wins and MFE_ENV is not needed.
+# Remote image: SHELL_ORIGINS (space or comma separated origins) become the CORS allow-list.
+set -eu
+
+runtime="${MFE_RUNTIME_DIR:-/tmp/mfe-runtime}"
+configs="${MFE_CONFIGS_DIR:-/opt/mfe/configs}"
+
+fail() {
+  echo "mfe: $*" >&2
+  exit 1
+}
+
+write_cors() {
+  case "$1" in
+    *'
+'*) fail "SHELL_ORIGINS must not contain a newline" ;;
+  esac
+  lines=""
+  for origin in $(echo "$1" | tr ',' ' '); do
+    case "$origin" in
+      http:// | https://) fail "SHELL_ORIGINS entry '$origin' has no host" ;;
+      http://* | https://*) ;;
+      *) fail "SHELL_ORIGINS entry '$origin' is not an origin like https://shop.example.com" ;;
+    esac
+    case "$origin" in
+      *[!A-Za-z0-9.:/_-]* | */*/*/*) fail "SHELL_ORIGINS entry '$origin' is not a plain origin (no path, no spaces)" ;;
+    esac
+    lines="$lines\"$origin\" \"$origin\";
+"
+  done
+  mkdir -p "$runtime"
+  out="$runtime/cors-origins.map"
+  printf '%s' "$lines" > "$out" || fail "cannot write $out; make /tmp writable"
+  echo "mfe: CORS allowed for $(echo "$1" | tr ',' ' ')"
+}
+
+pick_runtime_config() {
+  if [ -f "$runtime/runtime-config.json" ]; then
+    echo "mfe: using the runtime-config.json already in $runtime"
+    return
+  fi
+  if [ -n "${MFE_ENV+set}" ]; then
+    case "$MFE_ENV" in
+      '' | *[!A-Za-z0-9._-]* | *..*) fail "MFE_ENV='$MFE_ENV' is not a plain environment name (letters, digits, . _ -)" ;;
+    esac
+    chosen="$configs/runtime-config.$MFE_ENV.json"
+    if [ ! -f "$chosen" ]; then
+      echo "mfe: no runtime config for MFE_ENV=$MFE_ENV. Available:" >&2
+      ls "$configs" >&2
+      exit 1
+    fi
+  elif [ -f "$configs/runtime-config.json" ]; then
+    chosen="$configs/runtime-config.json"
+  else
+    echo "mfe: no runtime config. Set MFE_ENV, or mount runtime-config.json in $runtime. Available in $configs:" >&2
+    ls "$configs" >&2 || true
+    exit 1
+  fi
+  mkdir -p "$runtime"
+  cp "$chosen" "$runtime/runtime-config.json" || fail "cannot write $runtime; make /tmp writable"
+  echo "mfe: runtime config from $chosen"
+}
+
+kind_file="${MFE_KIND_FILE:-/opt/mfe/kind}"
+if [ -f "$kind_file" ] && [ "$(cat "$kind_file")" = shell ] ||
+  { [ -d "$configs" ] && [ -n "$(ls "$configs" 2>/dev/null)" ]; }; then
+  pick_runtime_config
+elif [ -n "${SHELL_ORIGINS:-}" ]; then
+  write_cors "$SHELL_ORIGINS"
+fi

package/assets/features/deploy-docker/files/Dockerfile

@@ -0,0 +1,48 @@
+# One Dockerfile for every app. Pick the app with a build argument:
+#
+#   docker build -f docker/Dockerfile --build-arg APP=shell   -t shop-shell:1.0.0 .
+#   docker build -f docker/Dockerfile --build-arg APP=catalog -t shop-catalog:1.0.0 .
+#
+# Build once, run anywhere: nothing about an environment is baked in. The shell reads its runtime
+# config at start (MFE_ENV picks runtime-config.<env>.json); a remote reads the shell origins it
+# allows (SHELL_ORIGINS). Both base images are pinned by digest; Dependabot or a manual bump moves
+# them. Run from the repository root so pnpm-lock.yaml is in the build context.
+
+ARG NODE_IMAGE=node:24.22.2-slim@sha256:c86ecead9e55a5210ac1727de38a4ca840bf03dcaf34dc9749addbf383b1920c
+ARG NGINX_IMAGE=nginx/nginx-unprivileged:1.30.6-alpine3.24@sha256:2daef144b574804198caccc4041819fa1801ecd5df2252a39646bfa2b1ff3bea
+
+# Node 24 still ships corepack; Node 25 and later do not.
+FROM ${NODE_IMAGE} AS build
+ARG APP=shell
+ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+RUN corepack enable
+WORKDIR /app
+COPY . .
+RUN pnpm install --frozen-lockfile
+RUN case "${APP}" in ''|*[!a-z0-9-]*) echo "APP must be an app name from mfeflow.json" >&2; exit 1;; esac
+RUN pnpm --filter "./apps/${APP}" build
+RUN set -eu; \
+    kind="$(node -p "require('./mfeflow.json').apps['${APP}'].kind")"; \
+    version="$(node -p "require('./apps/${APP}/package.json').version")"; \
+    case "${version}" in ''|*[!0-9A-Za-z.+-]*) echo "unusable version: ${version}" >&2; exit 1;; esac; \
+    mkdir -p /out/html /out/configs; \
+    echo "${kind}" > /out/kind; \
+    cp -R "apps/${APP}/dist/." /out/html/; \
+    if [ "${kind}" = shell ]; then \
+      if [ -d /out/html/config ]; then mv /out/html/config/runtime-config*.json /out/configs/; rm -r /out/html/config; fi; \
+      cp docker/nginx.shell.conf /out/default.conf; \
+    else \
+      sed -e "s/__NAME__/${APP}/g" -e "s/__VERSION__/${version}/g" docker/nginx.remote.conf > /out/default.conf; \
+    fi
+
+FROM ${NGINX_IMAGE}
+COPY --from=build /out/html /usr/share/nginx/html
+COPY --from=build /out/configs /opt/mfe/configs
+COPY --from=build /out/kind /opt/mfe/kind
+COPY --from=build /out/default.conf /etc/nginx/conf.d/default.conf
+COPY --chmod=755 docker/40-mfe-config.sh /docker-entrypoint.d/40-mfe-config.sh
+# The base image already runs as user 101 (nginx). The start script writes to /tmp/mfe-runtime.
+EXPOSE 8080
+# busybox wget ships with the alpine image; there is no curl.
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+  CMD wget -q -O /dev/null http://127.0.0.1:8080/healthz || exit 1

package/assets/features/deploy-docker/files/compose-registry.json.eta

@@ -0,0 +1,19 @@
+<% const used = new Set(it.apps.flatMap((a) => (a.port === undefined ? [] : [a.port])));
+let spare = 8080;
+const ports = Object.fromEntries(it.apps.map((a) => {
+  if (a.port !== undefined) return [a.name, a.port];
+  while (used.has(spare)) spare++;
+  used.add(spare);
+  return [a.name, spare];
+}));
+-%>
+{
+  "env": "local",
+  "remotes": [
+<% const remotes = it.apps.filter((a) => a.kind === 'remote'); remotes.forEach((a, i) => { %>    {
+      "name": "<%= a.name %>",
+      "entry": "http://localhost:<%= ports[a.name] %>/mf-manifest.json",
+      "routes": ["/<%= a.name %>"]
+    }<%= i < remotes.length - 1 ? ',' : '' %>
+<% }) %>  ]
+}

package/assets/features/deploy-docker/files/compose.yaml.eta

@@ -0,0 +1,50 @@
+<% const used = new Set(it.apps.flatMap((a) => (a.port === undefined ? [] : [a.port])));
+let spare = 8080;
+const ports = Object.fromEntries(it.apps.map((a) => {
+  if (a.port !== undefined) return [a.name, a.port];
+  while (used.has(spare)) spare++;
+  used.add(spare);
+  return [a.name, spare];
+}));
+const shell = it.apps.find((a) => a.kind === 'shell');
+const shellPort = shell === undefined ? 4300 : ports[shell.name]; -%>
+# Runs the shell and every remote locally from one image build each, on the ports mfeflow.json gives
+# them. The image is the same one you would deploy: only the environment variables differ.
+#
+#   docker compose up --build
+#   MFE_ENV=staging docker compose up
+#
+# Ports bind to 127.0.0.1 only. An app with no port in mfeflow.json gets a spare one starting at
+# 8080; set a port for it in mfeflow.json if you want a fixed one.
+#
+# The shell may only load remotes from origins its runtime config allows. Add them to
+# apps/shell/public/config/runtime-config.<env>.json (and rebuild):
+#   "registryOrigins": [<%= it.apps.filter((a) => a.kind === 'remote').map((a) => '"http://localhost:' + ports[a.name] + '"').join(', ') %>]
+x-app: &app
+  read_only: true
+  tmpfs:
+    - /tmp
+  security_opt:
+    - no-new-privileges:true
+  cap_drop:
+    - ALL
+  restart: unless-stopped
+
+services:
+<% for (const a of it.apps) { %>  <%= a.name %>:
+    <<: *app
+    build:
+      context: .
+      dockerfile: docker/Dockerfile
+      args:
+        APP: <%= a.name %>
+<% if (a.kind === 'shell') { %>    environment:
+      MFE_ENV: ${MFE_ENV:-dev}
+    volumes:
+      # The shell reads its registry index from its own origin. This one lists the remotes below.
+      - ./docker/compose-registry.json:/tmp/mfe-registry/index.json:ro
+<% } else { %>    environment:
+      SHELL_ORIGINS: http://localhost:<%= shellPort %>
+<% } %>    ports:
+      - '127.0.0.1:<%= ports[a.name] %>:8080'
+<% } %>

package/assets/features/deploy-docker/files/docker.md

@@ -0,0 +1,52 @@
+# Docker
+
+This project can package each app as a small nginx image. Everything here is plain code in your repository: change it, or delete it. mfeflow does not call it.
+
+## Files
+
+- `docker/Dockerfile`: one file for every app. `--build-arg APP=<name>` picks the app from `mfeflow.json`.
+- `docker/nginx.shell.conf` and `docker/nginx.remote.conf`: cache rules, the SPA fallback (shell only), CORS (remotes only).
+- `docker/40-mfe-config.sh`: runs before nginx starts and picks the runtime config.
+- `compose.yaml`: the shell and the remotes locally, on the ports from `mfeflow.json`.
+- `k8s/mfe.yaml`: the shell on Kubernetes, with the runtime config in a ConfigMap.
+- `.dockerignore`.
+
+## Build once, run in every environment
+
+```sh
+docker build -f docker/Dockerfile --build-arg APP=shell -t shop-shell:1.0.0 .
+docker run --read-only --tmpfs /tmp \
+  -e MFE_ENV=staging -p 8080:8080 shop-shell:1.0.0
+```
+
+`MFE_ENV` picks `runtime-config.<env>.json` from the build. The same image runs as `staging` or `prod`. If the file is missing the container stops and lists what it has.
+
+A remote image needs the origins of the shells that may load it:
+
+```sh
+docker build -f docker/Dockerfile --build-arg APP=catalog -t shop-catalog:1.0.0 .
+docker run --read-only --tmpfs /tmp \
+  -e SHELL_ORIGINS=https://staging.shop.example.com -p 8081:8080 shop-catalog:1.0.0
+```
+
+## What each path is cached for
+
+| Path                                        | Cache-Control                         |
+| ------------------------------------------- | ------------------------------------- |
+| `index.html`, `/config/runtime-config.json` | `no-cache`                            |
+| `/registry/index.json`, `mf-manifest.json`  | `no-cache`                            |
+| `/static/*` (hashed files)                  | `public, max-age=31536000, immutable` |
+| `/mfe/<name>/<version>/*` on a remote       | `public, max-age=31536000, immutable` |
+
+Bump the version in a remote's `package.json` for every release. The versioned path is cached for a year, so the same version must always mean the same files.
+
+## Registry index
+
+The shell reads `/registry/index.json` from its own origin. In Kubernetes put it in its own ConfigMap, mounted as a directory at `/tmp/mfe-registry`; with Docker mount a file at `/tmp/mfe-registry/index.json`, or set `registryUrls` in the runtime config to a registry you host elsewhere.
+
+## Notes
+
+- Compression is gzip. The nginx image has no brotli module.
+- The image runs as user 101 on port 8080 and works with a read-only root filesystem. nginx and the start script both write only under `/tmp`.
+- Build on Node 24. Node 25 and later no longer ship corepack.
+- The base images are pinned by digest. Update the tag and the digest together.

package/assets/features/deploy-docker/files/dockerignore

@@ -0,0 +1,17 @@
+# Keep the build context small and keep local state out of the image.
+node_modules
+**/node_modules
+**/dist
+**/.turbo
+**/coverage
+.git
+.github
+.env
+.env.*
+!.env.example
+*.log
+.DS_Store
+playwright-report
+test-results
+k8s
+compose.yaml

package/assets/features/deploy-docker/files/k8s.yaml

@@ -0,0 +1,114 @@
+# The shell on Kubernetes. Parsed as YAML in mfeflow's tests, not applied to a cluster. Change the
+# image, names and config to yours. A remote has the same shape: copy the Deployment and Service,
+# use its image, drop the ConfigMap and set SHELL_ORIGINS.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: mfe-shell-runtime
+data:
+  runtime-config.json: |
+    {
+      "environment": "prod"
+    }
+---
+# The registry index. Leave this out (and its mount below) if runtime-config.json points
+# registryUrls at a registry you host elsewhere.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: mfe-shell-registry
+data:
+  index.json: |
+    {
+      "env": "prod",
+      "remotes": []
+    }
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mfe-shell
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: mfe-shell
+  template:
+    metadata:
+      labels:
+        app: mfe-shell
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 101
+        runAsGroup: 101
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: shell
+          image: registry.example.com/mfe-shell:1.0.0
+          ports:
+            - name: http
+              containerPort: 8080
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 101
+            runAsGroup: 101
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ['ALL']
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            periodSeconds: 5
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 20
+          resources:
+            requests:
+              cpu: 25m
+              memory: 32Mi
+            limits:
+              memory: 128Mi
+          volumeMounts:
+            # nginx writes its pid file and temp files here, and the start script its config.
+            - name: tmp
+              mountPath: /tmp
+            # The ConfigMap is mounted as a whole directory on purpose. A file mounted with
+            # subPath never receives later changes to the ConfigMap; a directory mount does.
+            # The start script finds runtime-config.json here and leaves it alone, so MFE_ENV is
+            # not needed. To use the files baked into the image instead, set MFE_ENV and drop
+            # this mount.
+            - name: runtime
+              mountPath: /tmp/mfe-runtime
+              readOnly: true
+            - name: registry
+              mountPath: /tmp/mfe-registry
+              readOnly: true
+      volumes:
+        - name: runtime
+          configMap:
+            name: mfe-shell-runtime
+        - name: registry
+          configMap:
+            name: mfe-shell-registry
+        - name: tmp
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: mfe-shell
+spec:
+  selector:
+    app: mfe-shell
+  ports:
+    - name: http
+      port: 80
+      targetPort: http

package/assets/features/deploy-docker/files/nginx.remote.conf

@@ -0,0 +1,73 @@
+# A remote. __NAME__ and __VERSION__ are filled in when the image is built, from the app name and
+# its package.json version. The files are stored once and answer on two paths:
+#   /mfe/__NAME__/__VERSION__/...  the registry layout, cached for a year (the version is the name)
+#   /...                           the same files, revalidated every time
+# Any other /mfe/ path is a 404 here, so an old URL never gets a year of someone else's files.
+
+# The stock mime.types has no .mjs. This block sits at http level, where it adds to the stock
+# list; inside a server block a types block would replace the whole list.
+types {
+  text/javascript mjs;
+}
+
+# add_header is not inherited by a location that sets its own, so every location repeats the
+# security headers beside Cache-Control.
+gzip on;
+gzip_vary on;
+gzip_min_length 256;
+gzip_types text/css text/javascript application/javascript application/json image/svg+xml;
+# This image has no brotli module. Let a CDN or ingress do brotli if you want it.
+
+# The shell origins the start script wrote from SHELL_ORIGINS. With none set the file does not
+# exist (the * makes nginx accept that), the variable is empty and no CORS header is sent.
+map $http_origin $mfe_cors_origin {
+  default "";
+  include /tmp/mfe-runtime/cors-origins*.map;
+}
+
+server {
+  listen 8080;
+  server_name _;
+  server_tokens off;
+  root /usr/share/nginx/html;
+
+  location = /healthz {
+    access_log off;
+    default_type text/plain;
+    return 200 "ok\n";
+  }
+
+  # Dotfiles (.env, .git) are never served. .well-known stays reachable.
+  location ~ /\.(?!well-known) { return 404; }
+
+  location ^~ /mfe/__NAME__/__VERSION__/ {
+    alias /usr/share/nginx/html/;
+    add_header Cache-Control "public, max-age=31536000, immutable";
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Access-Control-Allow-Origin $mfe_cors_origin always;
+    add_header Vary Origin always;
+  }
+
+  location ^~ /mfe/ { return 404; }
+
+  # Hashed build output.
+  location ^~ /static/ {
+    try_files $uri =404;
+    add_header Cache-Control "public, max-age=31536000, immutable";
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Access-Control-Allow-Origin $mfe_cors_origin always;
+    add_header Vary Origin always;
+  }
+
+  # mf-manifest.json, remoteEntry.js and everything else without a hash in its name.
+  location / {
+    try_files $uri =404;
+    add_header Cache-Control "no-cache" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Access-Control-Allow-Origin $mfe_cors_origin always;
+    add_header Vary Origin always;
+  }
+}