Dockerfile

# Builder stage - uses TARGETPLATFORM by default for correct musl binaries
FROM node:24-alpine AS builder

WORKDIR /app

# Install build dependencies for native modules
RUN apk add --no-cache python3 py3-setuptools make g++ git

# Copy package files and install all dependencies
COPY package*.json ./
RUN npm ci

# Copy source code files in order of change frequency (least to most likely to change)
COPY shared ./shared
COPY lib ./lib
COPY data ./data
COPY migrations ./migrations
COPY scripts ./scripts
COPY processes ./processes
COPY src ./src
COPY public ./public
COPY ecosystem.config.js next.config.ts tailwind.config.ts postcss.config.mjs tsconfig.json ./
COPY esbuild.discord-bot.config.mjs esbuild.scheduler.config.mjs esbuild.migrator.config.mjs esbuild.stats-processor.config.mjs eslint.config.mjs ./

# Build Next.js app and bundle processes
RUN npm run build

# Prune dev dependencies while we still have build tools (needed for native modules on ARM)
RUN npm prune --omit=dev

# Collect only the process-specific deps (and their transitive deps) from node_modules
RUN node scripts/collect-process-deps.mjs /tmp/process-deps/node_modules

FROM node:24-alpine AS runner
WORKDIR /app

# Install required packages for s6-overlay and runtime
RUN apk add --no-cache \
    bash \
    coreutils \
    shadow \
    tzdata \
    git \
    curl \
    ffmpeg

# Install s6-overlay
ARG S6_OVERLAY_VERSION=3.2.0.3
ARG S6_OVERLAY_ARCH=x86_64

RUN curl -L "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz" | tar -C / -Jxpf - && \
    curl -L "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-${S6_OVERLAY_ARCH}.tar.xz" | tar -C / -Jxpf -

# Set s6-overlay environment variables
ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2
ENV S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0
ENV S6_SYNC_DISKS=1
ENV S6_RC_STARTUP_TIMEOUT=30000
ENV S6_VERBOSITY=2

# Create abc user (standard for s6-overlay containers)
RUN addgroup -g 1001 abc && \
    adduser -u 1001 -G abc -h /config -s /bin/bash -D abc

# Copy built Next.js application (includes minimal node_modules)
COPY --from=builder /app/public ./public
COPY --from=builder --chown=abc:abc /app/.next/standalone ./
COPY --from=builder --chown=abc:abc /app/.next/static ./.next/static
RUN chmod -R a-w /app/public /app/.next/static

# Copy bundled process files (optimized with esbuild)
COPY --from=builder /app/dist ./dist

# Copy runtime dependencies and application files (needed by processes and migrations)
COPY --from=builder /app/lib ./lib
COPY --from=builder /app/src ./src
COPY --from=builder /app/shared ./shared
COPY --from=builder --chown=abc:abc /app/data ./data
RUN chmod -R a-w /app/data
COPY --from=builder /app/migrations ./migrations
COPY --from=builder /app/scripts ./scripts

# Copy migration runner script directly from host with execute permissions
COPY --chmod=755 scripts/run-migrations.sh ./scripts/

# Copy package files for reference
COPY --from=builder /app/package.json /app/package-lock.json ./

# Copy process-specific dependencies (auto-collected with transitive deps)
COPY --from=builder /tmp/process-deps/node_modules ./node_modules/

# Copy s6-overlay configuration
COPY --chmod=755 s6-overlay/s6-rc.d /etc/s6-overlay/s6-rc.d/
COPY --chmod=755 s6-overlay/cont-init.d /etc/cont-init.d/

# Create app_data directory and set ownership
RUN mkdir -p /app/app_data/data /app/logs && \
    chown -R abc:abc /app/app_data /app/logs

# Note: PUID/PGID can be set at runtime (defaults to 1001:1001 in cont-init.d/10-adduser)
# Unraid users should set -e PUID=99 -e PGID=100 when running the container

EXPOSE 3000

ENV PORT=3000
ENV NODE_ENV=production
ENV HOSTNAME=0.0.0.0
ENV TZ=UTC

# Add health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
  CMD curl -f http://localhost:3000/api/health || exit 1

# s6-overlay requires root to start its supervision tree; individual services drop to abc (uid 1001) via s6 service config
# nosemgrep: dockerfile.security.missing-user-entrypoint.missing-user-entrypoint
ENTRYPOINT ["/init"]