Only install npm packages needed for production about meteor-base HOT 13 CLOSED

We actually do meteor npm install --only=prod

from meteor-base.

@SimonSimCity

Well, and here it gets tricky. I see some of my dev-dependencies in this folder.

That makes sense if NODE_ENV wasn't set to production or the --production flag wasn't passed to npm install.

Is this command independent of an existing package.json file?

Judging by a quick skim through the source code that appears to be the case.

Isn't all this anyways already covered when calling npm install in the folder $APP_BUNDLE_FOLDER/bundle/programs/server

I believe that only installs the dependencies from the Meteor-generated package.json and $APP_BUNDLE_FOLDER/bundle/programs/server/npm is simply copied from the first stage with no package.json from what I can see. In that case setting NODE_ENV in the second stage like I suggested may not do the trick, I'll look into this a bit more and get back to you.
Interestingly enough $APP_BUNDLE_FOLDER/bundle/programs/server/npm does not contain any dev dependencies for me even though I'm only setting NODE_ENV=production in the second stage.

Going back to the bcrypt wiki they also recommend running the rebuild command after npm install due to an existing limitation, I don't have any deeper knowledge about the matter, but I thought this is worth mentioning.

Alpine linux based images use musl libc instead of the standard glibc and thus are not compatible with compiled binaries. node-pre-gyp currently does not test the pre-compiled binaries to be ABI-compatible and thus you may see segfaults. We are working to resolve this issue.

As a workaround, In alpine based images, force recompiling the bcrypt native addon after a npm install with this command: npm rebuild bcrypt --build-from-source.

from meteor-base.

Seems like we should just add ENV NODE_ENV=production to the example Dockerfile, shouldn’t we? High enough up that it gets set before any npm install commands get run, with a comment explaining its effect. Doing it via environment variable provides users a way to toggle it off, since build-app-npm-dependencies.sh is inside the parent image.

Is that equivalent to npm install --production or meteor npm install --only=prod? Is there any reason this shouldn’t be the default? Since this Docker image runs the app via node, I think it always runs in production mode rather than development mode.

from meteor-base.

According to https://docs.npmjs.com/cli-commands/install.html, npm install --production is the same as NODE_ENV=production npm install. It also states that --only overrides the environment variable.

To me it would be good to mention the environment variable and its effect to nodejs.

To state this clear - I would like if you'd add this to the sample - to show what's possible and what makes sense.

from meteor-base.

@SimonSimCity do you want to open a PR with what you had in mind? I was assuming we’d just add ENV NODE_ENV=production plus a comment before line 4 of https://github.com/disney/meteor-base/blob/master/example/default.dockerfile.

from meteor-base.

@SimonSimCity do you want to open a PR with what you had in mind? I was assuming we’d just add ENV NODE_ENV=production plus a comment before line 4 of https://github.com/disney/meteor-base/blob/master/example/default.dockerfile.

I would normally add it to the second stage as it's common for dev dependencies to be used during the build process (to use a CSS autoprefixer for example). I would instead add it before line 18 or so, the second npm install should only install production dependencies.

from meteor-base.

@khawaga thanks for the response - this actually makes more sense.

I've created a new meteor project added several npm-packages as dev- and normal dependencies and could confirm that they were not included in the final bundle after calling meteor build.

But interestingly, the package.json file, whose packages are installed by running $SCRIPTS_FOLDER/build-meteor-npm-dependencies.sh contain dev-dependencies ... Does anyone know what they're needed for? They're about 275kb in size, so it's not as extreme as I thought it was.

from meteor-base.

Why do we after all run npm rebuild --build-from-source in the folder $APP_BUNDLE_FOLDER/bundle/programs/server/npm? In my samples there is no package.json file there, and the npm packages seem to be updated when calling npm install in $APP_BUNDLE_FOLDER/bundle/programs/server - see the run install. So not even any package would need the --build-from-source flag - actually - isn't it?

from meteor-base.

@SimonSimCity I've checked the resulting image and package.json in $APP_BUNDLE_FOLDER/bundle/programs/server does not correspond to the npm dependencies in $APP_BUNDLE_FOLDER/bundle/programs/server/npm and is generated by meteor itself regardless of your app's actual dependencies (see: https://github.com/meteor/meteor/blob/release/METEOR%401.9/scripts/dev-bundle-server-package.js)
The dependencies in $APP_BUNDLE_FOLDER/bundle/programs/server/npm correspond to your app's dependencies.
npm rebuild is necessary as the second stage may use a different Linux distribution (in the example it's using Alpine Linux) as opposed to Ubuntu in the first stage and that may require rebuilding if your application uses native dependencies (like bcrypt for example) as the binaries generated from the first stage may not be cross-compatible (see: https://github.com/kelektiv/node.bcrypt.js/wiki/Installation-Instructions#alpine-linux-based-images).

from meteor-base.

@khawaga Thanks for the detailed explanation.

package.json in $APP_BUNDLE_FOLDER/bundle/programs/server [...] is generated by meteor itself regardless of your app's actual dependencies

Ok, that's understood. Don't know why this one has dev-dependencies in it's list, but that's another topic, I guess.

The dependencies in $APP_BUNDLE_FOLDER/bundle/programs/server/npm correspond to your app's dependencies.

Well, and here it gets tricky. I see some of my dev-dependencies in this folder.

Furthermore, the script build-meteor-npm-dependencies.sh in its current version runs $npm_cmd rebuild --build-from-source inside the folder $APP_BUNDLE_FOLDER/bundle/programs/server and thereafter inside the folder $APP_BUNDLE_FOLDER/bundle/programs/server/npm. Is this command independent of an existing package.json file? At least in my setup there's no package.json within $APP_BUNDLE_FOLDER/bundle/programs/server/npm.

Isn't all this anyways already covered when calling npm install in the folder $APP_BUNDLE_FOLDER/bundle/programs/server by the there registered install script, which is already called in line 14 of build-meteor-npm-dependencies.sh?

from meteor-base.

I could confirm that dev-dependencies are not taken into the bundle created when calling meteor build - this means that there are no changes needed for this 😅

The image, having the dev-packages and the meteor environment, is discarded and only the bundle and the build-scripts of this repo are taken to the next build-stage.

Something in my project most likely is screwing things up - which is why I have dev-dependencies in there ...

from meteor-base.

this means that there are no changes needed for this 😅

So should we close the related PR?

from meteor-base.

If you mean #31 - this is not related to dev-packages of npm, which this ticket is about, but to build tools installed using apk. It will result in a much smaller final image, yes, but it focuses on something different.

from meteor-base.