Make iframe-outputs docker use nginx (#719)

* Make iframe-outputs docker use nginx

- Split Dockerfile into build and production stages
- pnpm install uses cache to speed up builds

* Address nginx warning

* Add healthz endpoint for `hub`

Author: markmiro

Dockerfile.iframe-outputs

@@ -1,29 +1,44 @@
-# Minimal Dockerfile for iframe outputs
-# Runs the iframe Vite dev server
-FROM node:23-alpine
+# syntax=docker/dockerfile:1.4
+# Build stage
+FROM node:23-alpine AS builder
 RUN npm install -g pnpm@latest
 WORKDIR /app
 
 # Copy workspace files
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 
-# Copy package files for workspace (needed for @runtimed/schema imports)
+# Copy schema package.json (only workspace dependency needed for iframe)
 COPY packages/schema/package.json packages/schema/tsconfig.json ./packages/schema/
-COPY packages/schema/src ./packages/schema/src
+
+# Install dependencies with cache mount
+RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store \
+    pnpm install --frozen-lockfile
 
 # Copy source files needed for iframe
+COPY packages/schema/src ./packages/schema/src
 COPY src/components/ui ./src/components/ui
 COPY src/lib ./src/lib
+COPY src/util/iframe.ts ./src/util/iframe.ts
 COPY src/components/outputs/shared-with-iframe ./src/components/outputs/shared-with-iframe
 COPY iframe-outputs ./iframe-outputs
 COPY vite.config.ts tsconfig.json tsconfig.node.json ./
 
-# Install all dependencies at root level
-RUN pnpm install --frozen-lockfile
+# Build the iframe outputs
+RUN pnpm build:iframe
+
+# Production stage
+FROM nginx:alpine
+
+# Copy built files from builder stage
+COPY --from=builder /app/iframe-outputs/worker/dist /usr/share/nginx/html
+
+# Copy nginx configuration
+COPY iframe-outputs/nginx-main.conf /etc/nginx/nginx.conf
+COPY iframe-outputs/nginx.conf /etc/nginx/conf.d/default.conf
 
-# Expose port for local testing
+# Expose port 8000
 EXPOSE 8000
 
-# Run the vite dev server
-CMD ["pnpm", "dev:iframe", "--host"]
+# Start nginx
+CMD ["nginx", "-g", "daemon off;"]
 

iframe-outputs/nginx-main.conf

@@ -0,0 +1,17 @@
+# The default nginx configuration causes this warning in the logs when running in hub:
+# nginx: [warn] the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:2
+# So we're overriding it here.
+events {
+    worker_connections 1024;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    sendfile on;
+    keepalive_timeout 65;
+
+    include /etc/nginx/conf.d/*.conf;
+}
+

iframe-outputs/nginx.conf

@@ -0,0 +1,22 @@
+server {
+    listen 8000;
+    root /usr/share/nginx/html;
+    index index.html react.html;
+
+    gzip on;
+
+    # Allow iframe embedding
+    add_header Content-Security-Policy "frame-ancestors *;" always;
+
+    # Health check endpoint
+    location /healthz {
+        access_log off;
+        return 200 "healthy\n";
+        add_header Content-Type text/plain;
+    }
+
+    # Serve static files
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}