Node.js İçin Docker: Kimsenin Anlatmadığı Production-Ready Kurulum

# Bunu yap — root olarak çalışma
FROM node:20-slim
 
RUN groupadd --gid 1001 nodejs \
  && useradd --uid 1001 --gid nodejs --shell /bin/bash --create-home nodejs
 
USER nodejs
WORKDIR /home/nodejs/app

# .dockerignore — bunu oluştur, ciddi ol
node_modules
.git
.gitignore
.env*
*.md
tests
coverage
.vscode
.eslint*
.prettier*
docker-compose*.yml
Dockerfile

# Kötü — herhangi bir kod değişikliği npm install'ı tetikler
COPY . .
RUN npm install
 
# İyi — önce sadece package dosyalarını kopyala
COPY package.json package-lock.json ./
RUN npm ci
COPY . .

# ===== Aşama 1: Bağımlılıklar =====
FROM node:20-slim AS deps
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci
 
# ===== Aşama 2: Build =====
FROM node:20-slim AS builder
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
RUN npm run build
 
# ===== Aşama 3: Production =====
FROM node:20-slim AS runner
WORKDIR /app
 
RUN groupadd --gid 1001 nodejs \
  && useradd --uid 1001 --gid nodejs --shell /bin/bash --create-home nodejs
 
# Sadece production'da gereken şeyleri kopyala
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/package.json ./package.json
 
USER nodejs
EXPOSE 3000
CMD ["node", "dist/server.js"]

# ===== Aşama 1: Tüm bağımlılıklar (build için) =====
FROM node:20-slim AS deps-all
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci
 
# ===== Aşama 2: Sadece production bağımlılıkları =====
FROM node:20-slim AS deps-prod
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev
 
# ===== Aşama 3: Build =====
FROM node:20-slim AS builder
WORKDIR /app
COPY --from=deps-all /app/node_modules ./node_modules
COPY . .
RUN npm run build
 
# ===== Aşama 4: Production =====
FROM node:20-slim AS runner
WORKDIR /app
 
RUN groupadd --gid 1001 nodejs \
  && useradd --uid 1001 --gid nodejs --shell /bin/bash --create-home nodejs
 
COPY --from=deps-prod /app/node_modules ./node_modules
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/package.json ./package.json
 
USER nodejs
EXPOSE 3000
CMD ["node", "dist/server.js"]

# Alpine: bazı native modüller ek bağımlılık gerektirir
FROM node:20-alpine
RUN apk add --no-cache python3 make g++
# bcrypt, sharp ve diğer native modüller derleme gerektirir

FROM node:20-slim AS builder
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev
COPY . .
RUN npm run build
 
FROM gcr.io/distroless/nodejs20-debian12
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/package.json ./package.json
CMD ["dist/server.js"]

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD node -e "fetch('http://localhost:3000/api/health').then(r => { if (!r.ok) throw new Error(); })"

HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
  CMD node healthcheck.js

// healthcheck.js
const http = require("http");
 
const options = {
  hostname: "localhost",
  port: process.env.PORT || 3000,
  path: "/api/health",
  method: "GET",
  timeout: 4000,
};
 
const req = http.request(options, (res) => {
  process.exit(res.statusCode === 200 ? 0 : 1);
});
 
req.on("error", () => process.exit(1));
req.on("timeout", () => {
  req.destroy();
  process.exit(1);
});
 
req.end();

// src/routes/health.ts
import type { Request, Response } from "express";
 
export async function healthCheck(req: Request, res: Response) {
  const checks = {
    uptime: process.uptime(),
    timestamp: Date.now(),
    status: "ok" as "ok" | "degraded" | "error",
    checks: {} as Record<string, { status: string; latency?: number }>,
  };
 
  // Veritabanı bağlantısını kontrol et
  try {
    const start = Date.now();
    await db.query("SELECT 1");
    checks.checks.database = {
      status: "ok",
      latency: Date.now() - start,
    };
  } catch {
    checks.checks.database = { status: "error" };
    checks.status = "degraded";
  }
 
  // Redis bağlantısını kontrol et
  try {
    const start = Date.now();
    await redis.ping();
    checks.checks.redis = {
      status: "ok",
      latency: Date.now() - start,
    };
  } catch {
    checks.checks.redis = { status: "error" };
    checks.status = "degraded";
  }
 
  const statusCode = checks.status === "ok" ? 200 : 503;
  res.status(statusCode).json(checks);
}

# ❌ YANLIŞ — secret'lar katman geçmişinde kalır
ENV DATABASE_URL=postgres://user:password@host:5432/db
RUN echo "api_key=sk_live_abc123" > /app/.env
 
# ❌ YANLIŞ — ARG bile katman geçmişinde kalır
ARG GITHUB_TOKEN
RUN git clone https://${GITHUB_TOKEN}@github.com/org/private-repo.git

# syntax=docker/dockerfile:1
 
FROM node:20-slim AS builder
WORKDIR /app
COPY package.json package-lock.json ./
 
# Secret, bir dosya olarak mount edilir — katmana yazılmaz
RUN --mount=type=secret,id=npmrc,target=/root/.npmrc \
  npm ci
 
COPY . .
RUN npm run build

docker build --secret id=npmrc,src=$HOME/.npmrc -t myapp .

# İyi — çalışma zamanı env
docker run -e DATABASE_URL="postgres://..." -e API_KEY="sk_..." myapp
 
# Daha iyi — env dosyasından
docker run --env-file .env.production myapp

# docker-compose.yml
services:
  app:
    image: myapp
    environment:
      - DATABASE_URL=${DATABASE_URL}
      - REDIS_URL=${REDIS_URL}
    env_file:
      - .env.production

# docker-compose.yml (Swarm)
services:
  app:
    image: myapp
    secrets:
      - db_password
      - api_key
 
secrets:
  db_password:
    external: true
  api_key:
    external: true

import { readFileSync } from "fs";
 
const dbPassword = readFileSync("/run/secrets/db_password", "utf8").trim();

// server.ts — SIGTERM handler
const server = app.listen(port, () => {
  console.log(`Server listening on port ${port}`);
});
 
function gracefulShutdown(signal: string) {
  console.log(`${signal} received. Starting graceful shutdown...`);
 
  // Yeni bağlantıları kabul etmeyi durdur
  server.close(() => {
    console.log("HTTP server closed");
 
    // Veritabanı bağlantılarını kapat
    db.end()
      .then(() => {
        console.log("Database connections closed");
        process.exit(0);
      })
      .catch((err) => {
        console.error("Error during shutdown:", err);
        process.exit(1);
      });
  });
 
  // Zorla kapatma zamanlayıcısı
  setTimeout(() => {
    console.error("Graceful shutdown timed out. Forcing exit.");
    process.exit(1);
  }, 8000); // Docker'ın 10 saniyelik timeout'undan önce
}
 
process.on("SIGTERM", () => gracefulShutdown("SIGTERM"));
process.on("SIGINT", () => gracefulShutdown("SIGINT"));

FROM node:20-slim
 
# Tini'yi yükle
RUN apt-get update && apt-get install -y --no-install-recommends tini \
  && rm -rf /var/lib/apt/lists/*
 
ENTRYPOINT ["tini", "--"]
CMD ["node", "dist/server.js"]

docker run --init myapp

# docker-compose.production.yml
services:
  app:
    image: myapp:${VERSION:-latest}
    build:
      context: .
      dockerfile: Dockerfile
      target: runner
    restart: unless-stopped
    init: true
    ports:
      - "${PORT:-3000}:3000"
    environment:
      NODE_ENV: production
      PORT: "3000"
    env_file:
      - .env.production
    healthcheck:
      test: ["CMD", "node", "healthcheck.js"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "1.0"
        reservations:
          memory: 256M
          cpus: "0.25"
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp

# ❌ Kötü
docker build -t myapp:latest .
 
# ✅ İyi — Git SHA kullan
docker build -t myapp:$(git rev-parse --short HEAD) .
 
# ✅ İyi — Semantik versiyon
docker build -t myapp:2.1.0 .
 
# ✅ En iyi — İkisini birden
VERSION=$(git rev-parse --short HEAD)
docker build -t myapp:${VERSION} -t myapp:latest .
docker push myapp:${VERSION}

# syntax=docker/dockerfile:1
 
# ===== Aşama 1: Bağımlılıklar =====
FROM node:20-slim AS deps
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci
 
# ===== Aşama 2: Production Bağımlılıkları =====
FROM node:20-slim AS deps-prod
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev
 
# ===== Aşama 3: Build =====
FROM node:20-slim AS builder
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
RUN npm run build
 
# ===== Aşama 4: Production =====
FROM node:20-slim AS runner
LABEL maintainer="your-email@example.com"
LABEL org.opencontainers.image.source="https://github.com/your-org/your-repo"
 
WORKDIR /app
 
# Tini'yi yükle ve temizle
RUN apt-get update \
  && apt-get install -y --no-install-recommends tini \
  && rm -rf /var/lib/apt/lists/*
 
# Root olmayan kullanıcı oluştur
RUN groupadd --gid 1001 nodejs \
  && useradd --uid 1001 --gid nodejs --shell /bin/bash --create-home nodejs
 
# Sadece gerekli dosyaları kopyala
COPY --from=deps-prod /app/node_modules ./node_modules
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/package.json ./package.json
COPY healthcheck.js ./healthcheck.js
 
# Root olmayan kullanıcıya geç
USER nodejs
 
# Ortam değişkenleri
ENV NODE_ENV=production
ENV PORT=3000
 
EXPOSE 3000
 
# Health check
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
  CMD ["node", "healthcheck.js"]
 
# Tini init process'i ile başlat
ENTRYPOINT ["tini", "--"]
CMD ["node", "dist/server.js"]