Container Deployment & Operations Runbook

1. Multi-Stage Dockerfile Execution

The build workflow uses a 3-stage Dockerfile to produce a minimal runner image:

# Stage 1: Build Frontend React Assets
FROM node:20-alpine AS frontend-builder
WORKDIR /app/web
COPY web/package*.json ./
RUN npm ci
COPY web/ ./
RUN npm run build

# Stage 2: Build Golang Executable Binary
FROM golang:1.23-alpine AS backend-builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
COPY --from=frontend-builder /app/web/dist ./web/dist
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o portal cmd/server/main.go

# Stage 3: Minimal Production Runner Container
FROM alpine:3.19 AS runner
WORKDIR /app
RUN apk add --no-cache ca-certificates tzdata
COPY --from=backend-builder /app/portal .
COPY --from=backend-builder /app/keys ./keys

EXPOSE 9090
CMD ["./portal"]

---

2. Docker Compose Orchestration

version: '3.8'

services:
  intelektika-portal:
    build: .
    container_name: intelektika_portal_app
    restart: always
    ports:
      - "9090:9090"
    environment:
      - PORT=9090
      - MONGO_URI=mongodb://mongo:27017
      - MONGO_DB_NAME=intelektika_db
      - JWT_SECRET=production_super_secret_jwt_key
      - ENVIRONMENT=production
    depends_on:
      - mongo

  mongo:
    image: mongo:6.0
    container_name: intelektika_mongo_db
    restart: always
    volumes:
      - mongodb_data:/data/db

volumes:
  mongodb_data:

---

3. Operations & Troubleshooting Runbook

Problem / Symptom	Root Cause	Remediation Procedure
DRM License Sign Failure	Missing or corrupted RSA private key	Generate new RSA keypair in keys/ directory using OpenSSL.
MongoDB Connection Failure	MongoDB service unreachable	Check MongoDB container status using docker ps or verify MONGO_URI.
Server Handshake Rejected (403)	Hardware ID mismatch	Re-issue license token matching active school lab server hardware ID.