Multistage build for a Phoenix app using Elixir releases

Dockerfile

# Available versions: https://hub.docker.com/r/hexpm/elixir/tags
FROM hexpm/elixir:1.13.2-erlang-23.3.4.9-alpine-3.15.0 AS builder

# Install build tools.
RUN apk add --no-cache build-base git=2.34.2-r0

# Prepare build directory.
WORKDIR /app

# Copy the sources.
COPY . ./

# Install Hex and Rebar.
RUN mix local.hex --force && \
    mix local.rebar --force

# Build in prod env.
ENV MIX_ENV=prod

# Get and build dependencies.
RUN mix deps.get && \
    mix deps.compile

# Build assets.
RUN mix assets.build

# Assemble the release.
RUN mix release

# Prepare the release image.
FROM alpine:3.15.0 AS release

# Install dependencies:
# - Erlang requires ncurses-libs
# - the :ssl module dynamically links to openssl
RUN apk add --no-cache openssl ncurses-libs

WORKDIR /app
COPY --from=builder --chown=nobody:nobody /app/_build/prod/rel/app ./

# Use the user with minimal permissions.
RUN chown -R nobody:nobody /app
USER nobody:nobody
ENV HOME=/app

CMD ["sh", "-c", "bin/app eval MyApp.Release.migrate && bin/app start"]