diff --git a/backend/dops/.dockerignore b/backend/dops/.dockerignore index ab57381ff..b99c86319 100644 --- a/backend/dops/.dockerignore +++ b/backend/dops/.dockerignore @@ -1,3 +1,8 @@ -node_modules -build -dist +**/.cache/ +**/build/ +**/dist/ +**/node_modules/ +**/test/ +*.md +*.yml +*.yaml diff --git a/backend/dops/Dockerfile b/backend/dops/Dockerfile index 2fb54fca4..e41674f20 100644 --- a/backend/dops/Dockerfile +++ b/backend/dops/Dockerfile @@ -10,6 +10,16 @@ COPY . ./ # Create and Assign permissions to npm folder RUN mkdir /.npm && chmod 777 /.npm +# Add user so we don't need --no-sandbox. +RUN addgroup -S pptruser && adduser -S -G pptruser pptruser \ + # && mkdir -p /home/pptruser/Downloads /app \ + && chown -R pptruser:pptruser /home/pptruser \ + && chown -R pptruser:pptruser /app + + +# Run everything after as non-privileged user. +USER pptruser + # Install packages, build and keep only prod packages RUN npm ci RUN npm run build @@ -67,13 +77,15 @@ COPY --from=builder /app/dist ./dist RUN apk add --no-cache \ chromium \ + curl \ nss \ freetype \ harfbuzz \ ca-certificates \ ttf-freefont -ENV PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser +ENV PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true \ + PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser # Expose Port EXPOSE 5001 diff --git a/backend/dops/openshift.deploy.yml b/backend/dops/openshift.deploy.yml index 221558b64..473b23977 100644 --- a/backend/dops/openshift.deploy.yml +++ b/backend/dops/openshift.deploy.yml @@ -19,13 +19,13 @@ parameters: - name: DOMAIN value: apps.silver.devops.gov.bc.ca - name: CPU_REQUEST - value: "25m" + value: "250m" - name: MEMORY_REQUEST - value: "50Mi" + value: "500Mi" - name: CPU_LIMIT - value: "75m" + value: "500m" - name: MEMORY_LIMIT - value: "150Mi" + value: "1Gi" - name: MIN_REPLICAS description: The minimum amount of replicas for the horizontal pod autoscaler. value: "3" @@ -207,6 +207,9 @@ objects: spec: containers: - image: ${NAME}-${ZONE}-${COMPONENT}:${IMAGE_TAG} + securityContext: + capabilities: + add: ["NET_BIND_SERVICE"] imagePullPolicy: Always name: ${NAME} env: diff --git a/charts/onroutebc/Chart.yaml b/charts/onroutebc/Chart.yaml index 32cb58f1d..c811584fa 100644 --- a/charts/onroutebc/Chart.yaml +++ b/charts/onroutebc/Chart.yaml @@ -3,18 +3,14 @@ apiVersion: v2 name: onRouteBC description: Helm chart for onRouteBC type: application -version: 0.0.1 +version: 1.0.0 appVersion: "1.16.0" dependencies: # A list of the chart requirements (optional) - - name: service - version: 0.0.1 - repository: "file://../service" + - name: component + version: 1.0.0 + repository: "file:///home/ubuntu/action-deployer-helm/charts/component" alias: frontend - - name: service - version: 0.0.1 - repository: "file://../service" + - name: component + version: 1.0.0 + repository: "file:///home/ubuntu/action-deployer-helm/charts/component" alias: vehicles - - name: service - version: 0.0.1 - repository: "file://../service" - alias: dops diff --git a/frontend/openshift.deploy.yml b/frontend/openshift.deploy.yml index 532dc3814..79e1de759 100644 --- a/frontend/openshift.deploy.yml +++ b/frontend/openshift.deploy.yml @@ -185,6 +185,9 @@ objects: spec: containers: - image: ${NAME}-${ZONE}-${COMPONENT}:${IMAGE_TAG} + securityContext: + capabilities: + add: ["NET_BIND_SERVICE"] imagePullPolicy: Always name: ${NAME} ports: