Dockerfile.ui

# Use the official Node.js runtime as the base image for building
# SC-MOD-008 (internal security audit): standardized on
# node:22-alpine to match Dockerfile.coordinator + Dockerfile.gateway.
FROM node:22-alpine AS builder

# Set the working directory in the container
WORKDIR /app

# Copy UI package.json and package-lock.json to the working directory
COPY src/ui/package*.json ./

# Install the UI dependencies
RUN npm install

# Copy the UI source code to the working directory
COPY src/ui/ .

# Build the UI for production
RUN npm run build

# Use the unprivileged nginx image (designed to run as non-root).
# nginxinc/nginx-unprivileged:alpine runs as the 'nginx' user (UID 101)
# and binds to port 8080 by default. This fixes the trivy DS-0002
# "Image user should not be 'root'" HIGH finding and matches the
# non-root-user convention of Dockerfile.coordinator and Dockerfile.gateway.
FROM nginxinc/nginx-unprivileged:alpine

# Copy the built UI from the builder stage
COPY --from=builder /app/build /usr/share/nginx/html

# Replace the unprivileged image's default nginx config with our
# own (which has gzip + our server block, listening on 8080 for
# non-root binding).
COPY nginx.conf /etc/nginx/nginx.conf

# Explicitly switch to the 'nginx' user (UID 101) that ships with
# the unprivileged base image. trivy DS-0002 requires an explicit
# USER directive, even when the base image runs as non-root by
# default.
USER nginx

# Expose port 8080 (unprivileged default; was 80 in the v1.0.0 image)
EXPOSE 8080

# Start nginx (the unprivileged image's CMD already does this, but
# explicit for clarity)
CMD ["nginx", "-g", "daemon off;"]