Dockerfile improvements about loopback-next

[dhmlau]

@bmaupin, thanks for your suggestion.
Would it work better to use npm install --production then?

[bmaupin]

@bmaupin, thanks for your suggestion. Would it work better to use npm install --production then?

I think my original wording in the issue description was a bit misleading so I tried to update it. The short version is that npm ci --only=production is ideal for the final built image but will only work with some additional changes to the Dockerfile.

As far as I understand, npm install should only be used for local development. When building the application for deployment (especially for production), npm ci should be used. It ensures that the dependencies are installed cleanly and will also result in reproducible builds; this isn't the case with npm install because it may update packages in package-lock.json unless package versions are explicitly pinned.

In addition, modifying the existing Dockerfile (I think this is it? and replacing npm install with npm install --production will break the build, because the devDependencies are required for the npm run build command to work.

I had to solve this with a multi-stage build in my example above, where the first stage uses npm ci to install all dependencies (including devDependencies) and run the build, then in the second stage, the built JavaScript files are copied and npm ci --only=production is run to exclude devDependencies from the final container image.

[bmaupin]

I was working with a Loopback 4 application today and I noticed another issue with the generated Dockerfile: it does a build every time the container image is run. This of course is slower, and it also presents more potential points of failure at runtime.

The Dockerfile I proposed already remediates this, but I added an extra note about this in the issue description.