fix login containers

2025-08-11 15:17:33 +00:00 · 2025-07-26 09:22:41 +02:00
parent e0b0fd2128
commit 1c559a316e
26 changed files with 9317 additions and 128 deletions
--- a/.devcontainer/base/Dockerfile
+++ b/.devcontainer/base/Dockerfile
@@ -12,11 +12,6 @@ RUN apt-get update && \
    apt-get --no-install-recommends install -y \
    libgtk2.0-0 libgtk-3-0 libgbm-dev libnotify-dev libnss3 libxss1 libasound2 libxtst6 xauth xvfb && \
    apt-get clean && \
-    corepack enable && COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack prepare pnpm@9.1.2 --activate
+    corepack enable && COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack prepare pnpm@10.13.1 --activate

 USER node
-WORKDIR /home/node/preinstall
-COPY pnpm-lock.yaml ./
-RUN pnpm fetch
-RUN cd /home/node && pwd && ls -la && whoami
-RUN pnpm store path
--- a/.devcontainer/base/Dockerfile.dockerignore
+++ b/.devcontainer/base/Dockerfile.dockerignore
@@ -1,4 +1 @@
 *
-!pnpm-lock.yaml
-!pnpm-workspace.yaml
-!**/package.json
--- a/.devcontainer/base/devcontainer.json
+++ b/.devcontainer/base/devcontainer.json
@@ -1,20 +1,13 @@
 {
 	"$schema": "https://raw.githubusercontent.com/devcontainers/spec/refs/heads/main/schemas/devContainer.schema.json",
-	"name": "devcontainer",
-	"dockerComposeFile": "docker-compose.yml",
+	"name": "Base Container. Install and run Components yourself",
+	"dockerComposeFile": "docker-compose.yaml",
 	"service": "devcontainer",
 	"runServices": [
 		"devContainer",
 		"db"
 	],
 	"workspaceFolder": "/workspaces",
-	"features": {
-		"ghcr.io/devcontainers/features/go:1": {
-			"version": "1.24"
-		},
-		"ghcr.io/guiyomh/features/golangci-lint:0": {},
-		"ghcr.io/jungaretti/features/make:1": {}
-	},
 	"forwardPorts": [
 		3000,
 		3001,
@@ -22,11 +15,12 @@
 		8080
 	],
 	"onCreateCommand": "pnpm install --frozen-lockfile --recursive --prefer-offline",
-	"customizations": {
-		"jetbrains": {
-			"settings": {
-				"com.intellij:app:HttpConfigurable.use_proxy_pac": true
-			}
-		}
+	"features": {
+		"ghcr.io/devcontainers/features/go:1": {
+			"version": "1.24"
+		},
+		"ghcr.io/guiyomh/features/golangci-lint:0": {},
+		"ghcr.io/jungaretti/features/make:1": {},
+		"ghcr.io/devcontainers/features/docker-outside-of-docker": {}
 	}
 }
--- a/.devcontainer/base/docker-compose.yaml
+++ b/.devcontainer/base/docker-compose.yaml
@@ -31,32 +31,9 @@ services:
    ports:
      - "5432:5432"

-  mock-zitadel:
-    container_name: mock-zitadel
-    build:
-      context: ../../apps/login/integration/core-mock
-    ports:
-      - 22220:22220
-      - 22222:22222
-
-  login-integration:
-    container_name: login-integration
-    build:
-      context: ../..
-      dockerfile: build/login/Dockerfile
-    image: "${LOGIN_TAG:-zitadel-login:local}"
-    env_file: ../../apps/login/.env.test
-    network_mode: service:mock-zitadel
-    environment:
-      NODE_ENV: test
-      PORT: 3001
-    depends_on:
-      mock-zitadel:
-        condition: service_started
-
  zitadel:
-    image: "${ZITADEL_TAG:-ghcr.io/zitadel/zitadel:v4.0.0-rc.2}"
    container_name: zitadel
+    image: "${ZITADEL_TAG:-ghcr.io/zitadel/zitadel:v4.0.0-rc.2}"
    command: 'start-from-init --masterkey "MasterkeyNeedsToHave32Characters" --config /zitadel.yaml --steps /zitadel.yaml'
    volumes:
      - ../../apps/login/acceptance/pat:/pat:delegated
--- a/.devcontainer/login-integration-debug/devcontainer.json
+++ b/.devcontainer/login-integration-debug/devcontainer.json
@@ -1,9 +1,10 @@
 {
 	"$schema": "https://raw.githubusercontent.com/devcontainers/spec/refs/heads/main/schemas/devContainer.schema.json",
-	"name": "login-integration-debug",
+	"name": "Login Integration Hot Reload Container - Debug and Fix Pull Request Checks",
 	"dockerComposeFile": [
-		"../base/docker-compose.yml",
-		"docker-compose.yml"
+		"../base/docker-compose.yaml",
+		"../login-integration/docker-compose.yaml",
+		"docker-compose.yaml"
 	],
 	"service": "login-integration",
 	"runServices": [
@@ -11,8 +12,13 @@
 	],
 	"workspaceFolder": "/workspaces",
 	"forwardPorts": [
+		22220,
+		22222,
 		3001
 	],
 	"onCreateCommand": "pnpm install --filter . --filter @zitadel/login; cd apps/login; pnpm cypress install",
-	"postAttachCommand": "pnpm turbo daemon clean || true; pnpm turbo watch @zitadel/login#dev test:integration:login"
+	"postAttachCommand": "pnpm turbo daemon clean || true; pnpm turbo watch @zitadel/login#dev test:integration:login",
+	"features": {
+		"ghcr.io/devcontainers/features/docker-outside-of-docker": {}
+	}
 }
--- a/.devcontainer/login-integration-debug/docker-compose.yaml
+++ b/.devcontainer/login-integration-debug/docker-compose.yaml
@@ -2,5 +2,5 @@ services:
  login-integration:
    container_name: login-integration-debug
    extends:
-      file: ../base/docker-compose.yml
+      file: ../login-integration/docker-compose.yaml
      service: devcontainer
--- a/.devcontainer/login-integration/devcontainer.json
+++ b/.devcontainer/login-integration/devcontainer.json
@@ -1,8 +1,9 @@
 {
 	"$schema": "https://raw.githubusercontent.com/devcontainers/spec/refs/heads/main/schemas/devContainer.schema.json",
-	"name": "login-integration",
+	"name": "Login Integration One-Off Container - Reproduce Pull Request Checks",
 	"dockerComposeFile": [
-		"../base/docker-compose.yml"
+		"../base/docker-compose.yaml",
+		"./docker-compose.yaml"
 	],
 	"service": "devcontainer",
 	"runServices": [
@@ -10,8 +11,10 @@
 	],
 	"workspaceFolder": "/workspaces",
 	"forwardPorts": [
+		22220,
+		22222,
 		3001
 	],
-	"onCreateCommand": "pnpm install --frozen-lockfile --filter . --filter @zitadel/login; cd apps/login; pnpm cypress install",
-	"postAttachCommand": "cd apps/login; pnpm test:integration:login"
+	"onCreateCommand": "pnpm --filter @zitadel/login install --frozen-lockfile; pnpm --filter @zitadel/login exec cypress install",
+	"updateContentCommand": "pnpm --filter @zitadel/login test:integration:login"
 }
--- a/.devcontainer/login-integration/docker-compose.yaml
+++ b/.devcontainer/login-integration/docker-compose.yaml
@@ -0,0 +1,27 @@
+services:
+  devcontainer:
+    container_name: devcontainer-login-integration
+    env_file: ../../apps/login/.env.test
+    network_mode: service:mock-zitadel
+
+  login-integration:
+    container_name: login-integration
+    build:
+      context: ../..
+      dockerfile: build/login/Dockerfile
+    image: "${LOGIN_TAG:-zitadel-login:local}"
+    env_file: ../../apps/login/.env.test
+    network_mode: service:mock-zitadel
+    environment:
+      NODE_ENV: test
+      PORT: 3001
+      NEXT_PUBLIC_BASE_PATH: /ui/v2/login
+
+  mock-zitadel:
+    container_name: mock-zitadel
+    build:
+      context: ../../apps/login/integration/core-mock
+    ports:
+      - 22220:22220
+      - 22222:22222
+      - 3001:3001
--- a/.devcontainer/login-subtree/devcontainer.json
+++ b/.devcontainer/login-subtree/devcontainer.json
@@ -0,0 +1,22 @@
+{
+	"$schema": "https://raw.githubusercontent.com/devcontainers/spec/refs/heads/main/schemas/devContainer.base.schema.json",
+	"image": "mcr.microsoft.com/devcontainers/typescript-node:20-bookworm",
+	"name": "Login Subtree Container - Use the Login As If You Would Have Forked the Mirror Repo",
+	"workspaceFolder": "/login",
+	"workspaceMount": "source=${localWorkspaceFolder}/apps/login,target=/login,type=bind,consistency=cached",
+	"mounts": [],
+	"forwardPorts": [
+		22220,
+		22222,
+		3000,
+		3001
+	],
+	"features": {
+		"ghcr.io/devcontainers/features/go:1": {
+			"version": "1.24"
+		},
+		"ghcr.io/guiyomh/features/golangci-lint:0": {},
+		"ghcr.io/jungaretti/features/make:1": {},
+		"ghcr.io/devcontainers/features/docker-outside-of-docker": {}
+	}
+}
--- a/.devcontainer/turbo-lint-unit-debug/devcontainer.json
+++ b/.devcontainer/turbo-lint-unit-debug/devcontainer.json
@@ -1,9 +1,9 @@
 {
 	"$schema": "https://raw.githubusercontent.com/devcontainers/spec/refs/heads/main/schemas/devContainer.schema.json",
-	"name": "turbo-lint-unit-debug",
+	"name": "Turbo Lint and Unit Hot Reload Container - Debug and Fix Pull Request Checks",
 	"dockerComposeFile": [
-		"../base/docker-compose.yml",
-		"docker-compose.yml"
+		"../base/docker-compose.yaml",
+		"docker-compose.yaml"
 	],
 	"service": "turbo-lint-unit-debug",
 	"runServices": [
@@ -14,5 +14,8 @@
 		3001
 	],
 	"onCreateCommand": "pnpm install --recursive",
-	"postAttachCommand": "pnpm turbo daemon clean || true; pnpm turbo watch lint test:unit"
+	"postAttachCommand": "pnpm turbo daemon clean || true; pnpm turbo watch lint test:unit",
+	"features": {
+		"ghcr.io/devcontainers/features/docker-outside-of-docker": {}
+	}
 }
--- a/.devcontainer/turbo-lint-unit-debug/docker-compose.yaml
+++ b/.devcontainer/turbo-lint-unit-debug/docker-compose.yaml
@@ -1,6 +1,6 @@
 services:
  turbo-lint-unit-debug:
-    extends:
-      file: ../base/docker-compose.yml
-      service: devcontainer
    container_name: turbo-lint-unit-debug
+    extends:
+      file: ../base/docker-compose.yaml
+      service: devcontainer
--- a/.devcontainer/turbo-lint-unit/devcontainer.json
+++ b/.devcontainer/turbo-lint-unit/devcontainer.json
@@ -1,8 +1,8 @@
 {
 	"$schema": "https://raw.githubusercontent.com/devcontainers/spec/refs/heads/main/schemas/devContainer.schema.json",
-	"name": "turbo-lint-unit",
+	"name": "Turbo Lint and Unit One-Off Container - Reproduce Pull Request Checks",
 	"dockerComposeFile": [
-		"../base/docker-compose.yml"
+		"../base/docker-compose.yaml"
 	],
 	"service": "devcontainer",
 	"runServices": [
@@ -10,5 +10,5 @@
 	],
 	"workspaceFolder": "/workspaces",
 	"onCreateCommand": "pnpm install --frozen-lockfile --recursive",
-	"postAttachCommand": "pnpm turbo lint test:unit"
+	"updateContentCommand": "pnpm turbo lint test:unit"
 }
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,11 +1,14 @@
+
 # .git
 .codecov
 .github
 .gitignore
 .dockerignore
 **/Dockerfile
-/k8s/
-/node_modules/
+**/node_modules
+**/.pnpm-store
+**/.turbo
+**/.next
 /console/src/app/proto/generated/
 /console/.angular
 /console/tmp/
@@ -24,5 +27,5 @@ console/.angular
 console/node_modules
 console/src/app/proto/generated/
 console/tmp/
-.vscode
 build/*.Dockerfile
+
--- a/apps/login/.env.test
+++ b/apps/login/.env.test
@@ -1,4 +1,3 @@
-NEXT_PUBLIC_BASE_PATH="/ui/v2/login"
 ZITADEL_API_URL=http://localhost:22222
 ZITADEL_SERVICE_USER_TOKEN="yolo"
 EMAIL_VERIFICATION=true
--- a/apps/login/.gitignore
+++ b/apps/login/.gitignore
@@ -12,6 +12,5 @@ node_modules
 dist
 dist-ssr
 *.local
-.env
 .vscode
 /blob-report/
--- a/apps/login/Dockerfile
+++ b/apps/login/Dockerfile
@@ -3,21 +3,21 @@ FROM node:20-alpine AS base
 FROM base AS build
 ENV PNPM_HOME="/pnpm"
 ENV PATH="$PNPM_HOME:$PATH"
-RUN corepack enable && COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack prepare pnpm@9.1.2 --activate && \
-    apk update && apk add --no-cache && \
+RUN corepack enable && COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack prepare pnpm@10.13.1 --activate && \
+    apk update && \
    rm -rf /var/cache/apk/*
 WORKDIR /app
 COPY pnpm-lock.yaml ./
 RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store pnpm fetch --frozen-lockfile
 COPY package.json ./
-RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store pnpm install --frozen-lockfile --prod
+RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store pnpm install --frozen-lockfile
 COPY . .
 RUN pnpm build:login:standalone

 FROM scratch AS build-out
 COPY --from=build /app/.next/standalone /
 COPY --from=build /app/.next/static /.next/static
-COPY --from=build /app/public /public
+COPY public public

 FROM base AS login-standalone
 WORKDIR /runtime
@@ -25,12 +25,13 @@ RUN addgroup --system --gid 1001 nodejs && \
    adduser --system --uid 1001 nextjs
 # If /.env-file/.env is mounted into the container, its variables are made available to the server before it starts up.
 RUN mkdir -p /.env-file && touch /.env-file/.env && chown -R nextjs:nodejs /.env-file
-COPY ./scripts/ ./
+COPY --chown=nextjs:nodejs ./scripts/ ./
 COPY --chown=nextjs:nodejs --from=build-out / ./
 USER nextjs
-ENV HOSTNAME="0.0.0.0"
-ENV PORT=3000
+ENV HOSTNAME="0.0.0.0" \
+    NEXT_PUBLIC_BASE_PATH="/ui/v2/login" \
+    PORT=3000
 # TODO: Check healthy, not ready
 HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
-CMD ["/bin/sh", "-c", "node ./healthcheck.js http://localhost:${PORT}/ui/v2/login/healthy"]
-ENTRYPOINT ["./entrypoint.sh"]
+    CMD ["/bin/sh", "-c", "node /runtime/healthcheck.js http://localhost:${PORT}/ui/v2/login/healthy"]
+ENTRYPOINT ["/runtime/entrypoint.sh"]
--- a/apps/login/package.json
+++ b/apps/login/package.json
@@ -1,5 +1,5 @@
 {
-  "packageManager": "pnpm@9.1.2+sha256.19c17528f9ca20bd442e4ca42f00f1b9808a9cb419383cd04ba32ef19322aba7",
+  "packageManager": "pnpm@10.13.1",
  "name": "@zitadel/login",
  "private": true,
  "type": "module",
--- a/apps/login/pnpm-lock.yaml
+++ b/apps/login/pnpm-lock.yaml
--- a/build/login/Dockerfile
+++ b/build/login/Dockerfile
@@ -1,47 +1,52 @@
-FROM node:20-alpine AS base
+FROM node:20-alpine AS runtime

-FROM base AS build
+FROM runtime AS pnpm-base
+RUN apk add --no-cache libc6-compat
 ENV PNPM_HOME="/pnpm"
 ENV PATH="$PNPM_HOME:$PATH"
-RUN corepack enable && COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack prepare pnpm@9.1.2 --activate && \
-    apk update && apk add --no-cache && \
-    rm -rf /var/cache/apk/*
-WORKDIR /app
-COPY pnpm-lock.yaml pnpm-workspace.yaml  ./
-RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store \
-    pnpm fetch --frozen-lockfile \
-    --filter @zitadel/login \
-    --filter @zitadel/client \
-    --filter @zitadel/proto
-COPY package.json ./
-COPY apps/login/package.json ./apps/login/package.json
-COPY packages/zitadel-proto/package.json ./packages/zitadel-proto/package.json
-COPY packages/zitadel-client/package.json ./packages/zitadel-client/package.json
-RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store \
-    pnpm install --frozen-lockfile \
-    --filter @zitadel/login \
-    --filter @zitadel/client \
-    --filter @zitadel/proto
+RUN corepack enable && corepack prepare pnpm@10.13.1 --activate
+RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
+    pnpm add -g turbo@2.5.5
+
+FROM pnpm-base AS pruner
+WORKDIR /prune
 COPY . .
+RUN pnpm turbo prune @zitadel/login @zitadel/client @zitadel/proto --docker
+
+FROM pnpm-base AS installer
+WORKDIR /install
+COPY --from=pruner /prune/out/pnpm-lock.yaml ./
+RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
+    pnpm fetch --frozen-lockfile
+COPY --from=pruner /prune/out/json/ .
+RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
+    pnpm install --frozen-lockfile --ignore-scripts
+
+FROM pnpm-base AS builder
+WORKDIR /build
+COPY --from=installer /install/ .
+COPY --from=pruner /prune/out/full/ .
+COPY proto ./proto
 RUN pnpm turbo build:login:standalone

 FROM scratch AS build-out
-COPY --from=build /app/apps/login/.next/standalone /
-COPY --from=build /app/apps/login/.next/static /.next/static
-COPY --from=build /app/apps/login/public /public
+COPY --from=builder /build/apps/login/.next/standalone /
+COPY --from=builder /build/apps/login/.next/static /apps/login/.next/static
+COPY --from=builder /build/apps/login/public /apps/login/public

-FROM base AS login-standalone
+FROM runtime AS login-standalone
 WORKDIR /runtime
 RUN addgroup --system --gid 1001 nodejs && \
    adduser --system --uid 1001 nextjs
 # If /.env-file/.env is mounted into the container, its variables are made available to the server before it starts up.
 RUN mkdir -p /.env-file && touch /.env-file/.env && chown -R nextjs:nodejs /.env-file
-COPY apps/login/scripts ./
-COPY --chown=nextjs:nodejs --from=build-out . .
+COPY --chown=nextjs:nodejs apps/login/scripts ./
+COPY --chown=nextjs:nodejs --from=build-out / ./
+# Debug the final structure
 USER nextjs
 ENV HOSTNAME="0.0.0.0"
 ENV PORT=3000
 # TODO: Check healthy, not ready
 HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
-    CMD ["/bin/sh", "-c", "node ./healthcheck.js http://localhost:${PORT}/ui/v2/login/healthy"]
-ENTRYPOINT ["./entrypoint.sh"]
+    CMD ["/bin/sh", "-c", "node /runtime/healthcheck.js http://localhost:${PORT}/ui/v2/login/healthy"]
+ENTRYPOINT ["/runtime/entrypoint.sh"]
--- a/build/login/Dockerfile.dockerignore
+++ b/build/login/Dockerfile.dockerignore
@@ -23,6 +23,7 @@
 !packages/zitadel-proto/turbo.json

 !packages/zitadel-client/package.json
+!packages/zitadel-client/**/package.json
 !packages/zitadel-client/src
 !packages/zitadel-client/tsconfig.json
 !packages/zitadel-client/tsup.config.ts
@@ -30,8 +31,7 @@

 !proto

-*.md
-*.png
-node_modules
-*.test.ts
-*.test.tsx
+**/*.md
+**/node_modules
+**/*.test.ts
+**/*.test.tsx
--- a/docs/package.json
+++ b/docs/package.json
@@ -67,6 +67,5 @@
    "@docusaurus/module-type-aliases": "^3.8.1",
    "@docusaurus/types": "^3.8.1",
    "tailwindcss": "^3.2.4"
-  },
-  "packageManager": "pnpm@9.1.2+sha256.19c17528f9ca20bd442e4ca42f00f1b9808a9cb419383cd04ba32ef19322aba7"
+  }
 }
--- a/package.json
+++ b/package.json
@@ -1,13 +1,19 @@
 {
-  "packageManager": "pnpm@9.1.2+sha256.19c17528f9ca20bd442e4ca42f00f1b9808a9cb419383cd04ba32ef19322aba7",
+  "packageManager": "pnpm@10.13.1",
  "private": true,
  "name": "zitadel-monorepo",
  "scripts": {
    "generate": "turbo run generate",
    "changeset": "changeset",
    "devcontainer": "devcontainer",
-    "devcontainer:lint-unit": "devcontainer up --config .devcontainer/turbo-lint-unit/devcontainer.json --workspace-folder .",
-    "devcontainer:integration:login": "devcontainer up --config .devcontainer/login-integration/devcontainer.json --workspace-folder ."
+    "devcontainer:lint-unit": "npm run devcontainer:lint-unit:build && npm run devcontainer:lint-unit:up",
+    "devcontainer:lint-unit:build": "devcontainer build --config .devcontainer/turbo-lint-unit/devcontainer.json --workspace-folder .",
+    "devcontainer:lint-unit:up": "devcontainer up --prebuild --config .devcontainer/turbo-lint-unit/devcontainer.json --workspace-folder . --remove-existing-container",
+    "devcontainer:integration:login": "npm run devcontainer:integration:login:build && pnpm devcontainer:integration:login:up",
+    "devcontainer:integration:login:build": "npm run devcontainer:integration:login:build:env && npm run devcontainer:integration:login:build:services",
+    "devcontainer:integration:login:build:env": "devcontainer build --config .devcontainer/login-integration/devcontainer.json --workspace-folder .",
+    "devcontainer:integration:login:build:services": "COMPOSE_BAKE=1 docker compose --file  .devcontainer/base/docker-compose.yaml --file .devcontainer/login-integration/docker-compose.yaml build login-integration",
+    "devcontainer:integration:login:up": "devcontainer up --prebuild --config .devcontainer/login-integration/devcontainer.json --workspace-folder . ----remove-existing-container"
  },
  "pnpm": {
    "overrides": {
@@ -19,7 +25,7 @@
  "devDependencies": {
    "@changesets/cli": "^2.29.5",
    "@devcontainers/cli": "^0.80.0",
-    "turbo": "2.5.5",
-    "sass": "^1.64.1"
+    "sass": "^1.64.1",
+    "turbo": "2.5.5"
  }
 }
--- a/packages/zitadel-client/package.json
+++ b/packages/zitadel-client/package.json
@@ -1,4 +1,5 @@
 {
+  "packageManager": "pnpm@10.13.1",
  "name": "@zitadel/client",
  "version": "1.2.0",
  "license": "MIT",
--- a/packages/zitadel-proto/package.json
+++ b/packages/zitadel-proto/package.json
@@ -1,4 +1,5 @@
 {
+  "packageManager": "pnpm@10.13.1",
  "name": "@zitadel/proto",
  "version": "1.2.0",
  "license": "MIT",