Dockerfile

# Build frontend.
# Always pin to the BUILDPLATFORM so npm runs natively on the runner —
# the output is platform-independent JS/HTML, there's nothing to gain
# (and a lot to lose) from emulating arm64 npm via QEMU. tsx + the
# rest of the dev toolchain make emulated arm64 builds drag from
# minutes into hours.
FROM --platform=$BUILDPLATFORM node:20-alpine AS webbuild
WORKDIR /src/web
COPY web/package*.json ./
RUN npm ci
COPY web/ ./
RUN npm run build

# Build backend (must satisfy go.mod `go 1.25.0`).
# Same trick: stay on the build platform and let Go cross-compile to
# TARGETOS/TARGETARCH. Go's CGO_ENABLED=0 cross-compile is essentially
# free, while emulating arm64 Go through QEMU is slow.
FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS gobuild
ARG VERSION=dev
ARG TARGETOS
ARG TARGETARCH
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY cmd/ ./cmd/
COPY internal/ ./internal/
COPY README.md LICENSE ./
COPY --from=webbuild /src/web/dist ./web/dist
RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -trimpath -ldflags "-s -w -X github.com/morezhou/hearth/internal/server.Version=${VERSION}" -o /out/hearth ./cmd/hearth && \
    CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -trimpath -ldflags "-s -w" -o /out/reset-password ./cmd/reset-password

# Prepare default writable data dirs for the nonroot runtime.
# When a named volume is first attached to /data, Docker copies existing image
# contents into it (including permissions), so this avoids permission issues.
RUN mkdir -p /out/data/icons /out/data/cache \
	&& chmod -R 0777 /out/data

# CA certificates (needed for HTTPS background providers like Bing/Unsplash/Picsum).
FROM alpine:3.20 AS certs
RUN apk add --no-cache ca-certificates

# Runtime
# Note: run as root by default to avoid volume permission issues across hosts and
# existing volumes created by older image versions.
FROM gcr.io/distroless/base-debian12
WORKDIR /hearth
COPY --from=gobuild /out/hearth /hearth/hearth
COPY --from=gobuild /out/reset-password /hearth/reset-password
COPY --from=gobuild /src/web/dist /hearth/web/dist
COPY --from=gobuild /out/data /data
COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
USER 0
ENV HEARTH_ADDR=:8787
ENV HEARTH_DATA_DIR=/data
ENV HEARTH_DB_DSN=/data/hearth.db
EXPOSE 8787
VOLUME ["/data"]
ENTRYPOINT ["/hearth/hearth"]