From 24f4ab15b45e5082377414f9f024d60b765004be Mon Sep 17 00:00:00 2001
From: Graham Knop <haarg@haarg.org>
Date: Wed, 7 Feb 2024 13:01:07 +0100
Subject: [PATCH 1/2] Dockerfile: only copy prereq definition files before
 installing

Rather than copying everything into the docker image immediately, only
copy the package.json, package-lock.json, cpanfile, and
cpanfile.snapshot. This will allow those layers to be cached when doing
building as code changes are made.
---
 Dockerfile | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 768195c4ff1..132e821863b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,17 +13,19 @@ RUN curl -sL https://deb.nodesource.com/setup_18.x | bash \
     && npm install -g npm \
     && rm -rf /var/lib/apt/lists/* /root/.npm
 
-COPY . /metacpan-web/
 WORKDIR /metacpan-web
 
+COPY package.json package-lock.json .
 RUN npm install --verbose && npm cache clean --force
 
+COPY --chown=metacpan:users cpanfile cpanfile.snapshot .
 RUN cpanm --notest App::cpm \
     && cpm install -g Carton \
     && useradd -m metacpan-web -g users \
     && cpm install -g ${CPM_ARGS}\
     && rm -fr /root/.cpanm /root/.perl-cpm /tmp/*
 
+COPY . /metacpan-web/
 RUN chown -R metacpan-web:users /metacpan-web
 
 USER metacpan-web:users

From 21df98502400170ae6267a34d9a54ebe3e2b97f1 Mon Sep 17 00:00:00 2001
From: Graham Knop <haarg@haarg.org>
Date: Wed, 7 Feb 2024 13:05:14 +0100
Subject: [PATCH 2/2] Dockerfile: use cache mounts rather than deleting
 packaging files

Preserve apt, npm, and cpm's build cache directories in cache mounts
rather than deleting them during the build. This allows them to be
reused between builds, as well as automatically removing them from the
built image.

Also revise RUN commands to use heredocs to be easier to read.
---
 Dockerfile | 51 ++++++++++++++++++++++++++++++---------------------
 1 file changed, 30 insertions(+), 21 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 132e821863b..5e20f6f1bd4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,31 +4,40 @@ ARG CPM_ARGS=--with-test
 
 ENV NO_UPDATE_NOTIFIER=1
 
-SHELL ["/bin/bash", "-o", "pipefail", "-c"]
-
-RUN curl -sL https://deb.nodesource.com/setup_18.x | bash \
-    && apt-get update \
-    && apt-get install -y -f --no-install-recommends libcmark-dev dumb-init nodejs \
-    && apt-get clean \
-    && npm install -g npm \
-    && rm -rf /var/lib/apt/lists/* /root/.npm
-
-WORKDIR /metacpan-web
-
-COPY package.json package-lock.json .
-RUN npm install --verbose && npm cache clean --force
+RUN \
+    --mount=type=cache,target=/var/cache/apt,sharing=private \
+    --mount=type=cache,target=/var/lib/apt/lists,sharing=private \
+    --mount=type=cache,target=/root/.npm,sharing=private \
+<<EOT /bin/bash -euo pipefail
+    curl -fsSL https://deb.nodesource.com/setup_21.x | bash -
+    apt update
+    apt install -y -f --no-install-recommends nodejs
+    npm install -g npm
+    apt install -y -f libcmark-dev dumb-init
+EOT
+
+WORKDIR /metacpan-web/
+RUN chown metacpan:users /metacpan-web/
+
+COPY --chown=metacpan:users package.json package-lock.json .
+RUN \
+    --mount=type=cache,target=/root/.npm,sharing=private \
+<<EOT /bin/bash -euo pipefail
+    npm install --verbose
+    npm audit fix
+EOT
 
 COPY --chown=metacpan:users cpanfile cpanfile.snapshot .
-RUN cpanm --notest App::cpm \
-    && cpm install -g Carton \
-    && useradd -m metacpan-web -g users \
-    && cpm install -g ${CPM_ARGS}\
-    && rm -fr /root/.cpanm /root/.perl-cpm /tmp/*
+RUN \
+    --mount=type=cache,target=/root/.perl-cpm,sharing=private \
+<<EOT /bin/bash -euo pipefail
+    cpm install -g ${CPM_ARGS}
+EOT
 
-COPY . /metacpan-web/
-RUN chown -R metacpan-web:users /metacpan-web
+COPY --chown=metacpan:users . .
+RUN mkdir var && chown metacpan:users var
 
-USER metacpan-web:users
+USER metacpan
 
 EXPOSE 5001