Dockerfile

# syntax=docker/dockerfile:1.7
#
# Next.js dev server in a container. The compose service bind-mounts the
# host's frontend/ source over /app so editing on the host triggers
# next-dev hot reload — except /app/node_modules and /app/.next which are
# anonymous volumes so the host's (possibly wrong-arch) modules can't leak
# into the container.
# Base image pinned by digest for reproducible builds (tag kept for
# readability). Re-resolve periodically to pick up upstream security patches:
#   docker buildx imagetools inspect node:20-bookworm-slim
FROM node:20-bookworm-slim@sha256:2cf067cfed83d5ea958367df9f966191a942351a2df77d6f0193e162b5febfc0

ENV NEXT_TELEMETRY_DISABLED=1 \
    CI=true

WORKDIR /app

# Layer 1: dependencies. Cached unless package-lock.json changes.
COPY package.json package-lock.json ./
RUN npm ci

# Layer 2: source. In dev mode the compose bind mount overrides this; we
# still COPY so `docker run` without volumes is bootable.
COPY . .

EXPOSE 3000

# -H 0.0.0.0 so the container's port is reachable from outside.
CMD ["npm", "run", "dev", "--", "-H", "0.0.0.0", "-p", "3000"]