🚧 WIP

frontend/Dockerfile

@@ -0,0 +1,16 @@
+# Build stage (spec section 3.3: no privileged credentials in the frontend;
+# VITE_API_BASE_URL is the ONLY build arg and contains no secret).
+FROM node:22-alpine AS build
+WORKDIR /app
+ARG VITE_API_BASE_URL=/api/v1
+ENV VITE_API_BASE_URL=$VITE_API_BASE_URL
+COPY package.json package-lock.json* ./
+RUN npm install
+COPY . .
+RUN npm run build
+
+# Serve stage: nginx proxies /api to the backend over frontend-net.
+FROM nginx:1.27-alpine
+COPY --from=build /app/dist /usr/share/nginx/html
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+EXPOSE 80