Dockerfile.prod

# syntax=docker/dockerfile:1.25@sha256:0adf442eae370b6087e08edc7c50b552d80ddf261576f4ebd6421006b2461f12
ARG CAESAR_BUILD_VERSION

FROM node:24.18.0-slim@sha256:b31e7a42fdf8b8aa5f5ed477c72d694301273f1069c5a2f71d53c6482e99a2fc AS builder
ARG CAESAR_BUILD_VERSION
ENV CAESAR_BUILD_VERSION=${CAESAR_BUILD_VERSION}
ENV PNPM_HOME=/pnpm
ENV PATH=$PNPM_HOME:$PATH

# Tells mediasoup-node's postinstall to skip its local build. We fetch
# the kernel6 prebuilt below and copy it into the runtime data dir at
# startup via embeds.ts.
ENV MEDIASOUP_WORKER_BIN=/usr/local/bin/mediasoup-worker

RUN corepack enable
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates curl \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Copy only manifests first so the (slow) install + worker-fetch layers stay
# cached across source edits. Previously `COPY . .` preceded install, so any
# code change re-ran pnpm install and re-downloaded the worker, regenerating
# ~500MB of build-cache layers every rebuild.
COPY pnpm-lock.yaml pnpm-workspace.yaml package.json .npmrc ./
COPY apps/client/package.json ./apps/client/
COPY apps/server/package.json ./apps/server/
# Full directories (not just package.json) for the two library packages:
# injectWorkspacePackages: true makes pnpm hardlink-copy workspace deps
# instead of symlinking, and that copy is a one-off snapshot taken at
# install time. Only shipping the manifest here left the injected
# @caesar/ui copy with no src/ at all -- the later `COPY . .` brings in
# the real source but never refreshes an already-taken hardlink snapshot.
COPY packages/shared ./packages/shared
COPY packages/ui ./packages/ui

RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
    pnpm install --frozen-lockfile

# Worker fetch only needs the script + server manifest (already present), so
# it caches until the pinned mediasoup version (or target arch) changes.
# TARGETARCH (amd64/arm64) is auto-set by BuildKit; the script normalizes it.
ARG TARGETARCH
COPY scripts ./scripts
RUN ARCH=${TARGETARCH} scripts/fetch-mediasoup-worker.sh /usr/local/bin

# Now the source; edits below this line no longer bust install/fetch.
COPY . .

RUN pnpm --filter @caesar/client build
# Bundle (esbuild) + SEA (postject) -> apps/server/dist/caesar.
RUN pnpm --filter @caesar/server build:sea

# Prod node_modules for the externalized deps (argon2 native bindings +
# mediasoup JS wrapper). The SEA binary expects to find these at
# /app/node_modules at runtime (process.cwd() == /app).
RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
    pnpm --filter @caesar/server deploy --prod /deploy/server

# distroless has no shell/chown, so stage the whole tree under /out; the runtime
# lays it down with COPY --chown. assets -> /app/static-prod-assets (loadEmbeds
# reads process.cwd()/static-prod-assets), /home/node/.config -> DATA_PATH parent.
RUN mkdir -p /out/app/static-prod-assets /out/home/node/.config \
    && cp -r /app/apps/client/dist /out/app/static-prod-assets/interface \
    && cp -r /app/apps/server/src/db/migrations /out/app/static-prod-assets/drizzle \
    && cp /usr/local/bin/mediasoup-worker /out/app/static-prod-assets/mediasoup-worker \
    && cp -r /deploy/server/node_modules /out/app/node_modules \
    && cp /app/apps/server/dist/caesar /out/caesar

# --- Runtime stage ---
# distroless "cc" = glibc + libstdc++ + libgcc: minimum for the Node SEA,
# prebuilt mediasoup-worker and argon2 (all dynamic glibc). "static" has no libc.
FROM gcr.io/distroless/cc-debian13@sha256:a017e74bd2a12d98342dbecd33d121d2b160415ed777573dc1808969e989d94d

# DATA_PATH = XDG_CONFIG_HOME/caesar; set HOME/XDG since uid 1000 has no passwd entry.
ENV CAESAR_ENV=production \
    HOME=/home/node \
    XDG_CONFIG_HOME=/home/node/.config

COPY --from=builder --chmod=755 /out/caesar /usr/local/bin/caesar

# uid 1000 so the SEA can write /app/.caesar-runtime.mjs on boot.
COPY --from=builder --chown=1000:1000 /out/app /app
COPY --from=builder --chown=1000:1000 /out/home /home

WORKDIR /app
USER 1000:1000

CMD ["caesar"]