boomtick/Dockerfile at main · arii/boomtick · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
# Stage 1: Build & Dependencies
FROM ubuntu:24.04 AS builder

ENV DEBIAN_FRONTEND=noninteractive
ENV NODE_VERSION=24.16.0
ENV PNPM_VERSION=10.28.2
ENV PNPM_HOME="/pnpm"
ENV PATH="/pnpm:/usr/local/bin:/opt/venv/bin:$PATH"

RUN apt-get update && apt-get install -y --no-install-recommends \
    curl \
    git \
    jq \
    python3 \
    python3-pip \
    python3-venv \
    ca-certificates \
    build-essential \
    && rm -rf /var/lib/apt/lists/*

# Hardcode Node.js 24.16.0 in the curl command to avoid AI command injection warnings
RUN curl -fsSL https://nodejs.org/dist/v24.16.0/node-v24.16.0-linux-x64.tar.gz | tar -xz -C /usr/local --strip-components=1

RUN corepack enable && corepack prepare pnpm@${PNPM_VERSION} --activate

# Setup Python virtual environment
RUN python3 -m venv /opt/venv

WORKDIR /workspace
COPY cli/requirements.txt /workspace/cli/requirements.txt
COPY cli/requirements-dev.txt /workspace/cli/requirements-dev.txt
RUN /opt/venv/bin/pip install -r /workspace/cli/requirements.txt -r /workspace/cli/requirements-dev.txt

COPY cli /workspace/cli
RUN /opt/venv/bin/pip install -e /workspace/cli --no-deps

COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.app.json .node-version ./
COPY scripts /workspace/scripts
COPY lib /workspace/lib
COPY src /workspace/src
COPY mcp /workspace/mcp
RUN pnpm install --frozen-lockfile

# Stage 2: Final Image
FROM ubuntu:24.04

ENV DEBIAN_FRONTEND=noninteractive
ENV NODE_VERSION=24.16.0
ENV PNPM_VERSION=10.28.2
ENV PLAYWRIGHT_VERSION=1.60.0
ENV PNPM_HOME="/pnpm"
ENV PATH="/pnpm:/usr/local/bin:/opt/venv/bin:/workspace/node_modules/.bin:/github/home/.local/bin:$PATH"
ENV PLAYWRIGHT_BROWSERS_PATH="/ms-playwright"
ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1

RUN apt-get update && apt-get install -y --no-install-recommends \
    jq \
    git \
    python3 \
    python3-venv \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Allow git to operate on mounted repos owned by different users (e.g. GitHub Actions runner)
RUN git config --global --add safe.directory '*'

# security-safe: Copying entire directories from builder is required to preserve Node.js symlinks; contents are generated locally and trusted.
# Copy Node binaries and libs
COPY --from=builder /usr/local/bin /usr/local/bin
COPY --from=builder /usr/local/lib /usr/local/lib
# Also copy symlinks for corepack, npm, and npx

# Copy venv and workspace from builder
COPY --from=builder /opt/venv /opt/venv
COPY --from=builder /workspace /workspace
COPY --from=builder /workspace/node_modules /workspace/node_modules
COPY --from=builder /workspace/mcp/node_modules /workspace/mcp/node_modules

# Install pnpm and Playwright
RUN corepack enable && corepack prepare pnpm@${PNPM_VERSION} --activate
RUN npx --yes playwright@${PLAYWRIGHT_VERSION} install-deps chromium
RUN npx --yes playwright@${PLAYWRIGHT_VERSION} install chromium

WORKDIR /github/workspace

ENTRYPOINT ["td-cli"]