# syntax=docker/dockerfile:1.7

# ─── Stage 1: web build ───
FROM registry.jerryyan.top/library/node:22-alpine AS web
WORKDIR /web
RUN npm config set registry https://registry.npmmirror.com
COPY web/package.json web/pnpm-lock.yaml* ./
RUN corepack enable && (pnpm install --frozen-lockfile || pnpm install)
COPY web .
RUN pnpm build

# ─── Stage 2: go build ───
FROM registry.jerryyan.top/library/golang:1.25-alpine AS go
WORKDIR /src
RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories \
    && apk add --no-cache git
ENV GOPROXY=https://goproxy.cn,direct
COPY go.mod go.sum ./
RUN go mod download
COPY . .
COPY --from=web /web/dist/. ./cmd/server/web/dist/
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags='-s -w' -o /out/server ./cmd/server

# ─── Stage 3: runtime ───
FROM registry.jerryyan.top/library/alpine:3.24
# nodejs/npm 供安装 ACP agent CLI（claude-code-acp / codex / gemini-cli 等，
# 均为 npm 包）。npm 全局 prefix 指到 /data/npm-global（持久卷），容器内
# `npm i -g xxx` 一次安装，重建镜像后无需重装；binary_path 填
# /data/npm-global/bin/<cli> 即可。
# bubblewrap + util-linux(prlimit/setpriv) 供 acp.sandbox mode=uid/container 使用：
# - prlimit 给 agent 子进程套 RLIMIT_AS/NPROC/CPU/FSIZE（sandbox_uid_linux.go）
# - bubblewrap 作 rootless 隔离（USER app 无 CAP_SYS_ADMIN，bwrap 走 user namespace）
# mode=none（默认）时这些工具不被调用，安装它们对默认部署无副作用。
RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories \
    && apk add --no-cache ca-certificates tzdata git openssh-client nodejs npm \
       bubblewrap util-linux && \
    addgroup -S app && adduser -S app -G app && \
    addgroup -S sandbox && \
    for i in 0 1 2 3 4 5 6 7 8 9; do adduser -S -D -H -G sandbox "sbx$i" 2>/dev/null || true; done
WORKDIR /app
COPY --from=go /out/server /app/server
COPY migrations /app/migrations
RUN mkdir -p /data/uploads /data/npm-global && chown -R app:app /data
ENV APP_DATA_DIR=/data \
    APP_WORKSPACE_DATA_DIR=/data \
    APP_STORAGE_LOCALFS_BASE_PATH=/data/uploads \
    NPM_CONFIG_PREFIX=/data/npm-global \
    NPM_CONFIG_REGISTRY=https://registry.npmmirror.com \
    PATH=/data/npm-global/bin:$PATH
USER app
EXPOSE 8080
ENTRYPOINT ["/app/server"]