Dockerfile

# ──────────────────────────────────────────────
# Marinara Engine — Multi-stage Docker Build
# ──────────────────────────────────────────────

# ── Stage 1: Build ──
FROM node:24-trixie-slim@sha256:0711b541c1c33a8a530ac4f0d391baa9a15b3d804695b1b24a47daa5fb60e74d AS builder
ARG BUILD_COMMIT
ARG BUILD_BRANCH
WORKDIR /app

# Copy workspace config first (layer cache for deps)
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
COPY packages/shared/package.json packages/shared/
COPY packages/server/package.json packages/server/
COPY packages/client/package.json packages/client/
COPY scripts/clean-stale-client-artifacts.mjs scripts/clean-stale-client-artifacts.mjs
COPY scripts/ensure-native-deps.mjs scripts/ensure-native-deps.mjs

# Enable corepack — version is read from the packageManager field in package.json
RUN corepack enable && corepack install

# Install all dependencies (including dev for building)
# Use cache mount to avoid storing pnpm store in image
RUN --mount=type=cache,target=/app/.pnpm-store \
    pnpm install --frozen-lockfile

# Copy source code
COPY tsconfig.base.json ./
COPY packages/shared/ packages/shared/
COPY packages/server/ packages/server/
COPY packages/client/ packages/client/

# Build everything: shared → server + client in parallel
# Increase heap for ARM64 emulation (QEMU) where memory pressure is high
ENV NODE_OPTIONS="--max-old-space-size=4096"
RUN pnpm build

# Bake the git ref into build-meta.json because the runtime image has no .git directory.
# __dirname in build-info.js resolves to packages/server/dist/config/
RUN BUILD_COMMIT="$BUILD_COMMIT" BUILD_BRANCH="$BUILD_BRANCH" node -e 'const fs = require("node:fs"); const meta = {}; if (process.env.BUILD_COMMIT) meta.commit = process.env.BUILD_COMMIT; if (process.env.BUILD_BRANCH) meta.branch = process.env.BUILD_BRANCH; if (Object.keys(meta).length > 0) fs.writeFileSync("packages/server/dist/config/build-meta.json", JSON.stringify(meta));'

# ── Stage 2: Production ──
FROM node:24-trixie-slim@sha256:0711b541c1c33a8a530ac4f0d391baa9a15b3d804695b1b24a47daa5fb60e74d AS production
WORKDIR /app

# llama-server dynamically links these at runtime
RUN apt-get update && apt-get install -y --no-install-recommends \
      libssl3 \
      libgomp1 \
      libvulkan1 \
      bubblewrap \
      python3 \
      python3-venv \
    && rm -rf /var/lib/apt/lists/*

# Copy workspace config
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
COPY packages/shared/package.json packages/shared/
COPY packages/server/package.json packages/server/
COPY packages/client/package.json packages/client/
COPY scripts/clean-stale-client-artifacts.mjs scripts/clean-stale-client-artifacts.mjs
COPY scripts/ensure-native-deps.mjs scripts/ensure-native-deps.mjs

# Enable corepack — version is read from the packageManager field in package.json
RUN corepack enable && corepack install

# Install production deps only
# Use cache mount to avoid storing pnpm store in image
# Strip onnxruntime-web WASM blobs, uses onnxruntime-node (native)
RUN --mount=type=cache,target=/app/.pnpm-store \
    pnpm install --frozen-lockfile --prod && \
    rm -rf /app/node_modules/.pnpm/onnxruntime-web@*

# Copy built artifacts from builder
COPY --from=builder /app/packages/shared/dist packages/shared/dist
COPY --from=builder /app/packages/server/dist packages/server/dist
COPY --from=builder /app/packages/client/dist packages/client/dist
COPY scripts/docker-entrypoint.mjs /usr/local/bin/marinara-docker-entrypoint.mjs
COPY scripts/install-backgroundremover.mjs scripts/install-backgroundremover.mjs
# The storage downgrade escape hatch (#4708) — docs/TROUBLESHOOTING.md tells
# Docker users to run it in a one-off container, so it must ship in the image.
COPY scripts/protect-launcher-data.mjs scripts/protect-launcher-data.mjs

# User guides served by the in-app documentation viewer (/api/docs)
COPY README.md README.md
COPY docs/ docs/

# Ensure /app/data exists for runtime use (file storage, uploads, generated assets)
RUN mkdir -p /app/data && \
    chown node:node /app/data

# Point the server at /app/data regardless of working directory
ENV DATA_DIR=/app/data
ENV FILE_STORAGE_DIR=/app/data/storage
# Pin the Claude Agent SDK + synthetic-session writer to a path under the
# already-chowned data volume. Avoids the post-setuid HOME=/root trap and
# makes the future "mount your host ~/.claude here" workflow a single
# -v flag for the user.
ENV CLAUDE_CONFIG_DIR=/app/data/claude-config

# File-native storage + user uploads live in /app/data at runtime.
# Mount a volume here for persistence.
VOLUME /app/data

# Default port
ENV PORT=7860
ENV HOST=0.0.0.0
ENV NODE_ENV=production
ENV MARINARA_DOCKER=true
ENV MARINARA_DOCKER_USER=node
ENV MARINARA_DOCKER_GROUP=node
EXPOSE 7860

USER root

# Run the server (serves both API and client SPA)
ENTRYPOINT ["node", "/usr/local/bin/marinara-docker-entrypoint.mjs"]
CMD ["node", "packages/server/dist/index.js"]