Dockerfile.backend

# syntax=docker/dockerfile:1.7
ARG BUN_IMAGE=oven/bun:1.3.14-slim@sha256:d56a2534ffd262e92c12fd3249d3924d296d97086da773f821d7d0477435ea04

FROM ${BUN_IMAGE} AS codex-cli
ARG TARGETARCH
ARG NODE_VERSION=24.19.0
ARG NODE_SHA256_AMD64=14b342e71204f811bde6153be8e04b62aef63c236fef92b55f9c83154b409647
ARG NODE_SHA256_ARM64=01443c1e1a29e531ccad5a46fefa6df490d2189c49f7955904aecdbb0fe86fdc
ARG CODEX_CLI_VERSION=0.153.3
USER root
RUN case "$TARGETARCH" in \
      amd64) node_arch=x64; node_sha="$NODE_SHA256_AMD64" ;; \
      arm64) node_arch=arm64; node_sha="$NODE_SHA256_ARM64" ;; \
      *) echo "unsupported TARGETARCH: $TARGETARCH" >&2; exit 1 ;; \
    esac \
    && apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates curl xz-utils \
    && rm -rf /var/lib/apt/lists/* \
    && curl -fsSLo /tmp/node.tar.xz \
      "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${node_arch}.tar.xz" \
    && printf '%s  %s\n' "$node_sha" /tmp/node.tar.xz | sha256sum -c - \
    && tar -xJf /tmp/node.tar.xz --strip-components=1 -C /usr/local \
    && rm /tmp/node.tar.xz \
    && npm install --global "@openai/codex@${CODEX_CLI_VERSION}" \
    && npm cache clean --force \
    && codex --version | grep -Fx "codex-cli ${CODEX_CLI_VERSION}"

FROM ${BUN_IMAGE} AS dependencies
WORKDIR /app

COPY backend/package.json backend/bun.lock ./backend/
COPY packages/agent-client/package.json ./packages/agent-client/
COPY packages/agent-harness/package.json ./packages/agent-harness/
COPY packages/artifact-formats/package.json ./packages/artifact-formats/
COPY packages/artifact-workspace/package.json ./packages/artifact-workspace/
COPY packages/sandbox-contract/package.json ./packages/sandbox-contract/
COPY packages/sandbox-daytona/package.json ./packages/sandbox-daytona/
COPY packages/sandbox-cube/package.json ./packages/sandbox-cube/
COPY packages/sandbox-box/package.json ./packages/sandbox-box/

WORKDIR /app/backend
RUN bun install --frozen-lockfile --production

FROM ${BUN_IMAGE} AS runtime-base
USER root
RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates clamav curl git openssh-client \
    && rm -rf /var/lib/apt/lists/* \
    && test -s /etc/ssl/certs/ca-certificates.crt \
    && clamscan --version \
    && git --version

FROM runtime-base AS runtime
RUN set -eux; \
    arch="$(uname -m)"; \
    case "$arch" in \
      x86_64|amd64) box_arch="x64" ;; \
      arm64|aarch64) box_arch="arm64" ;; \
      *) echo "Unsupported arch: $arch" >&2; exit 1 ;; \
    esac; \
    curl -fsSL "https://ascii.dev/api/box/cli/download?platform=linux-${box_arch}&channel=ascii-prod" \
      -o /usr/local/bin/box; \
    chmod +x /usr/local/bin/box

WORKDIR /app
COPY --from=dependencies /app/backend/node_modules ./backend/node_modules
COPY --from=codex-cli /usr/local/bin/node /usr/local/bin/node
COPY --from=codex-cli /usr/local/lib/node_modules/@openai/codex /usr/local/lib/node_modules/@openai/codex
COPY backend ./backend
COPY packages/agent-client ./packages/agent-client
COPY packages/agent-harness ./packages/agent-harness
COPY packages/artifact-formats ./packages/artifact-formats
COPY packages/artifact-workspace ./packages/artifact-workspace
COPY packages/sandbox-contract ./packages/sandbox-contract
COPY packages/sandbox-daytona ./packages/sandbox-daytona
COPY packages/sandbox-cube ./packages/sandbox-cube
COPY packages/sandbox-box ./packages/sandbox-box

RUN set -eux; \
    asset_dir=/app/backend/runtime-assets; \
    archive="$asset_dir/native-runtime-90dc3ebbb74b.tar.gz"; \
    test -f "$archive"; \
    printf '%s  %s\n' \
      'bb8a70f3a722a67fbd7838b73e427c863ed51e18b4705cd69297057e10ddff34' \
      "$asset_dir/dependencies/bun.lock" | sha256sum -c -; \
    printf '%s  %s\n' \
      '8a635e99dd0137f4c7cf2f54a5b17ec774d3e40e1932fe99e1804ec969b6e80e' \
      "$archive" | sha256sum -c -; \
    test "$(tar -xOzf "$archive" ./T3_SOURCE_COMMIT)" = \
      '90dc3ebbb74b0e85f41c4cb3105a9f8994ce0bfa'; \
    tar -xOzf "$archive" ./SHA256SUMS | sha256sum | \
      grep -Fx '6bc517c569e2da4179bee12488f592d4650fd9c374002b0fba15bffbe1d7b455  -'; \
    verify_dir="$(mktemp -d)"; \
    tar -xzf "$archive" -C "$verify_dir"; \
    (cd "$verify_dir" && sha256sum -c SHA256SUMS); \
    rm -rf "$verify_dir"; \
    bun -e \
      'const m=await Bun.file(process.argv[1]).json();const e={archiveName:"native-runtime-90dc3ebbb74b.tar.gz",archiveSha256:"8a635e99dd0137f4c7cf2f54a5b17ec774d3e40e1932fe99e1804ec969b6e80e",manifestSha256:"6bc517c569e2da4179bee12488f592d4650fd9c374002b0fba15bffbe1d7b455",sourceCommit:"90dc3ebbb74b0e85f41c4cb3105a9f8994ce0bfa",dependencyVersion:"0.0.39-nightly.20260906.1293",dependencyLockSha256:"bb8a70f3a722a67fbd7838b73e427c863ed51e18b4705cd69297057e10ddff34"};if(JSON.stringify(m)!==JSON.stringify(e))process.exit(1)' \
      "$asset_dir/manifest.json"

RUN ln -s backend/node_modules /app/node_modules \
    && ln -s ../lib/node_modules/@openai/codex/bin/codex.js /usr/local/bin/codex \
    && for package in agent-client agent-harness artifact-formats artifact-workspace sandbox-contract sandbox-daytona sandbox-cube sandbox-box; do \
      rm -rf "/app/backend/node_modules/@useagent/${package}"; \
      ln -s "../../../packages/${package}" "/app/backend/node_modules/@useagent/${package}"; \
    done \
    && mkdir -p \
      /app/backend/.artifacts \
      /app/backend/.runs \
      /app/backend/.slack-uploads \
      /var/lib/useagent/codex-app-server \
      /opt/useagent/native-runtime \
      /opt/useagent/pi-runtime \
    && ln -s /app/backend/runtime-assets/manifest.json /opt/useagent/native-runtime/manifest.json \
    && ln -s /app/backend/runtime-assets/native-runtime-90dc3ebbb74b.tar.gz \
      /opt/useagent/native-runtime/native-runtime-90dc3ebbb74b.tar.gz \
    && chown -R bun:bun \
      /app/backend/.artifacts \
      /app/backend/.runs \
      /app/backend/.slack-uploads \
      /var/lib/useagent/codex-app-server \
      /opt/useagent/native-runtime \
      /opt/useagent/pi-runtime

RUN codex --version | grep -Fx "codex-cli 0.153.3"

ARG RELEASE_COMMIT
RUN echo "${RELEASE_COMMIT}" | grep -Eq '^[0-9a-f]{40}$'

LABEL org.opencontainers.image.source="https://github.com/useagenthq/useagent" \
      org.opencontainers.image.revision="${RELEASE_COMMIT}" \
      org.opencontainers.image.title="useAgent backend"

ENV NODE_ENV=production \
    PORT=3201 \
    USEAGENT_BIND_HOST=0.0.0.0 \
    USEAGENT_RELEASE_COMMIT=${RELEASE_COMMIT}

USER bun
WORKDIR /app/backend
EXPOSE 3201
HEALTHCHECK --interval=5s --timeout=3s --start-period=15s --retries=12 \
  CMD ["bun", "-e", "fetch('http://127.0.0.1:'+(process.env.PORT||'3201')+'/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
CMD ["bun", "run", "src/index.ts"]