# One image, four processes (server, driver, executor, model); the compose file picks the command.
# Backend runs TypeScript natively on Node 24 (type stripping): no build step, only the frontend is bundled.
ARG NODE_IMAGE=node:24-slim@sha256:2fe369e969550cde8e867afc3fe370b260140cab4a23d467074295b42163d553
# Static docker client and compose plugin for the driver. It talks to a read-only socket proxy (DOCKER_HOST), never to the socket.
ARG DOCKER_CLI_IMAGE=docker:28.5.2-cli@sha256:625d9431a9f54c5a2bc90f24f0e1c3d55b1349fd857dd85035f98c2c9acbdd4d

# The claude CLI for the model sidecar, pinned and updated deliberately (docs/DESIGN.md, "Wykonawcy modeli").
ARG CLAUDE_CODE_VERSION=2.1.267
# The codex CLI for the model sidecar, pinned and updated deliberately (docs/DESIGN.md, "Wykonawcy modeli").
ARG CODEX_VERSION=0.156.1

FROM ${DOCKER_CLI_IMAGE} AS dockercli

FROM ${NODE_IMAGE} AS claude
ARG CLAUDE_CODE_VERSION
RUN npm install --global --prefix /opt/claude "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}" && npm cache clean --force

FROM ${NODE_IMAGE} AS codex
ARG CODEX_VERSION
RUN npm install --global --prefix /opt/codex "@openai/codex@${CODEX_VERSION}" && npm cache clean --force

FROM ${NODE_IMAGE} AS build
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci
COPY tsconfig.json vite.config.ts ./
COPY src ./src
RUN npm run build:web

FROM ${NODE_IMAGE} AS runtime
ARG REVISION=unknown
# Shown in the app's footer: the branch and the CI build number (empty in a local build).
ARG BRANCH=
ARG BUILD_NUMBER=
LABEL org.opencontainers.image.title="homelab-upgrade" org.opencontainers.image.revision="${REVISION}"
ENV BUILD_BRANCH=${BRANCH} BUILD_NUMBER=${BUILD_NUMBER} BUILD_REVISION=${REVISION}
ENV NODE_ENV=production HOST=0.0.0.0 PORT=8080 DB_PATH=/data/queue.sqlite WEB_DIR=/app/dist/web
WORKDIR /app
# bubblewrap for the function-runtime sidecar: without it the runtime refuses to run functions (no unsandboxed fallback).
RUN apt-get update && apt-get install -y --no-install-recommends bubblewrap git openssh-client && rm -rf /var/lib/apt/lists/*
COPY package.json package-lock.json ./
RUN npm ci --omit=dev && npm cache clean --force
COPY --from=build /app/dist/web ./dist/web
COPY --from=dockercli /usr/local/bin/docker /usr/local/bin/docker
COPY --from=dockercli /usr/local/libexec/docker/cli-plugins/docker-compose /usr/local/libexec/docker/cli-plugins/docker-compose
COPY --from=claude /opt/claude /opt/claude
COPY --from=codex /opt/codex /opt/codex
COPY bin ./bin
COPY src ./src
COPY config ./config
RUN chmod -R a+rX ./src ./config ./bin
USER node
CMD ["node", "src/main/server.ts"]
