Dockerfile.lite

# ── Lite image: No-Node Lite content on a plain Node Alpine base ──────
# Unlike the main Dockerfile, this image contains no node_modules, no apt
# toolchain, and no Rust build: the server is the esbuild single-file bundle
# from the Lite package, and the TLS native addon is the single prebuilt
# musl .node file staged by scripts/docker/stage-lite.mjs.
#
# It keeps the same runtime contract as the main image so the stock
# docker-compose.yml works with either image tag: /app layout, ./data and
# ./config bind mounts, and seeding of an empty config volume from /defaults.
#
# Build context must be staged first:
#   node scripts/docker/stage-lite.mjs --out docker-lite-stage \
#     --package <extracted lite package or staging tree> --native native/
#   docker build -f Dockerfile.lite docker-lite-stage

# The bundle prefers the node:sqlite builtin, stable in Node 22. Node 20's
# --experimental-sqlite is rejected by NODE_OPTIONS and not even compiled into
# every Node 20 build, and the Lite package ships no better-sqlite3 fallback —
# so this image pins Node 22.
FROM node:22-alpine

# Proxy version injected at build time via --build-arg PROXY_VERSION=x.y.z
# Falls back to package.json at runtime if not set.
ARG PROXY_VERSION=unknown

ENV CODEX_PROXY_HOST=0.0.0.0 \
    NODE_ENV=production \
    PROXY_VERSION=${PROXY_VERSION}

WORKDIR /app

COPY app/ ./app/
COPY public/ ./public/
COPY config/ ./config/
COPY bin/ ./bin/
COPY native/ ./native/

# The staged context carries the musl addon for both amd64 and arm64 (one
# image build per platform); keep only the one this architecture can load.
ARG TARGETARCH
RUN case "$TARGETARCH" in \
      arm64) rm -f native/codex-tls.linux-x64-musl.node ;; \
      *) rm -f native/codex-tls.linux-arm64-musl.node ;; \
    esac

COPY codex-proxy.sh ./
COPY THIRD-PARTY-NOTICES.txt ./
COPY docker-entrypoint.sh /docker-entrypoint.sh
RUN chmod +x /docker-entrypoint.sh

# Runtime data: --portable keeps everything under the package's data/
# directory; the compose ./data volume covers it directly.
RUN mkdir -p /app/data

# Backup default configs so the entrypoint can seed empty bind mounts.
RUN cp -r /app/config /defaults

EXPOSE 8080 11434

# No curl in this image: probe with the Node runtime itself.
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||8080)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

ENTRYPOINT ["/docker-entrypoint.sh"]
CMD ["node", "app/server.mjs", "--portable", "--mode=server"]