Bootstrap CodePress Live Dev Server recipe + dev Dockerfile

.codepress/dev-server/Dockerfile.web

@@ -0,0 +1,55 @@
+# Generated by CodePress bootstrap-dev-server.
+# Dev-mode image for the "web" frontend (Live Dev Server).
+# Edits are preserved, but running /codepress-bootstrap-dev-server again may overwrite them.
+FROM public.ecr.aws/docker/library/node:22-bookworm
+
+# System packages the dev runtime needs. `procps` only: this app's dependency tree
+# has no source-built native module (its single native package, `fsevents@1.1.2`,
+# is darwin-only and is skipped on linux), so no extra apt library is required.
+# The node-gyp toolchain (make/gcc/g++/python3) comes from the full -bookworm base.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends procps \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+# Package manager: yarn 1.x "classic", the only line that reads this repo's
+# `web/yarn.lock` (lockfile v1). The node:22-bookworm base already ships yarn
+# 1.22.22 at /usr/local/bin/yarn, so nothing is downloaded at run time and no
+# `corepack enable` is needed. Deliberately NOT corepack-managed: enabling
+# corepack would replace that working binary with a shim that resolves a version
+# at first use, which can reach the network during a cold start. This assertion
+# fails the build loudly if a future base image ever drops the bundled yarn.
+RUN yarn --version
+
+# THIN image: no `node_modules`, no source COPY. The dev-server runtime provides
+# dependencies at run time (squashfs hydration, or `yarn install --frozen-lockfile`
+# in this image against the bind-mounted checkout). Only the toolchain lives here.
+
+# HMR + bind config — values come from the runtime, never hardcoded.
+ENV HOSTNAME=0.0.0.0 \
+    CODEPRESS_BIND_HOST=0.0.0.0 \
+    PORT=3000 \
+    CODEPRESS_HMR_CLIENT_PORT=443 \
+    CODEPRESS_HMR_PROTOCOL=wss
+
+# react-scripts 1.x only skips webpack-dev-server's DNS-rebinding host check when
+# no `proxy` is set in package.json (the case today). Setting this keeps the
+# preview's `*.preview.codepress.dev` Host header accepted even if a `proxy` is
+# added later — the same role Vite's `server.allowedHosts` plays. Dev image only.
+ENV DANGEROUSLY_DISABLE_HOST_CHECK=true
+
+WORKDIR /app/web
+EXPOSE 3000
+
+# Put the app's bins on PATH as a backstop so anything that shells out to a
+# node_modules/.bin binary resolves it. These dirs are populated at run time on
+# the bind-mounted checkout. Prepend, never replace ${PATH}.
+ENV PATH="/app/web/node_modules/.bin:/app/node_modules/.bin:${PATH}"
+
+# Dev command (HMR on). react-scripts reads HOST and PORT from env, so CRA's HOST
+# is mapped from the CodePress bind var. WDS_SOCKET_PORT is carried for the uniform
+# runtime contract; react-scripts 1.x builds its HMR socket URL from
+# window.location, so the websocket rides the preview origin over wss on its own.
+# BROWSER=none stops react-dev-utils from trying to open a browser in the container.
+CMD ["sh", "-c", "HOST=\"${CODEPRESS_BIND_HOST:-0.0.0.0}\" WDS_SOCKET_PORT=\"${CODEPRESS_HMR_CLIENT_PORT:-443}\" BROWSER=none yarn start"]

.codepress/dev-server/recipe.json

@@ -0,0 +1,22 @@
+{
+  "schema_version": 1,
+  "bootstrapped_at": "2026-07-25T09:20:00Z",
+  "discovery_branch": "master",
+  "frontends": [
+    {
+      "label": "web",
+      "working_dir": "web",
+      "dockerfile_path": ".codepress/dev-server/Dockerfile.web",
+      "dev_command": "sh -c 'HOST=\"${CODEPRESS_BIND_HOST:-0.0.0.0}\" WDS_SOCKET_PORT=\"${CODEPRESS_HMR_CLIENT_PORT:-443}\" BROWSER=none yarn start'",
+      "prebuild_command": "",
+      "prebuild_inputs": [],
+      "framework": "cra",
+      "package_manager": "yarn",
+      "install_command": "yarn install --frozen-lockfile",
+      "dependency_manifests": ["web/yarn.lock"],
+      "dev_port": 3000,
+      "system_packages": ["procps"],
+      "size": "medium"
+    }
+  ]
+}