optio/Dockerfile.api at main · jonwiggins/optio · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
# ---- Dependencies stage ----
FROM node:26.12.1-bookworm-slim@sha256:28147155d47dc31abe0a46e0d12b59b2fb3d0a2dcc5dc65fce76a074180b16fe AS deps

RUN npm install -g pnpm@10.34.8

WORKDIR /app

# Copy workspace config
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml turbo.json tsconfig.base.json ./
COPY patches/ patches/

# Copy package.json for ALL workspace packages (pnpm needs full workspace graph)
COPY apps/api/package.json apps/api/tsconfig.json apps/api/drizzle.config.ts apps/api/
COPY apps/cli/package.json apps/cli/
COPY apps/web/package.json apps/web/
COPY apps/site/package.json apps/site/
COPY packages/shared/package.json packages/shared/tsconfig.json packages/shared/
COPY packages/container-runtime/package.json packages/container-runtime/tsconfig.json packages/container-runtime/
COPY packages/agent-adapters/package.json packages/agent-adapters/tsconfig.json packages/agent-adapters/
COPY packages/ticket-providers/package.json packages/ticket-providers/tsconfig.json packages/ticket-providers/
# Include every workspace manifest so the frozen lockfile matches.
COPY packages/mcp-bridge/package.json packages/mcp-bridge/

# Install production dependencies (--ignore-scripts avoids husky prepare hook)
RUN pnpm install --frozen-lockfile --ignore-scripts --prod --filter @optio/api...

# ---- Runtime stage ----
FROM node:26.12.1-bookworm-slim@sha256:28147155d47dc31abe0a46e0d12b59b2fb3d0a2dcc5dc65fce76a074180b16fe

ARG OPTIO_VERSION=dev
ENV OPTIO_VERSION=${OPTIO_VERSION}

# Verify Node ships OpenSSL >= 3.5 for post-quantum TLS (X25519MLKEM768)
RUN node -e 'const [maj,min] = process.versions.openssl.split(".").map(Number); if (maj < 3 || (maj === 3 && min < 5)) { console.error("OpenSSL " + process.versions.openssl + " too old; need >= 3.5"); process.exit(1); }'

# git + ca-certificates: required by the skill-sync worker for shallow-cloning
# marketplace skills (issue #497, Phase 2). Agent harnesses run only in
# isolated agent containers, never in this control-plane image.
RUN apt-get update \
    && apt-get upgrade -y \
    && apt-get install -y --no-install-recommends git ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Install tsx globally for TypeScript execution at runtime
# (workspace packages export .ts source, so the API runs via tsx)
# npm is only needed to install the launcher; keep its separate dependency tree
# out of the production image (agent package installs happen in agent pods).
RUN npm install -g tsx && npm uninstall -g npm && rm -rf /root/.npm

WORKDIR /app

# Copy production dependencies from deps stage
COPY --from=deps /app/ ./

# Copy source
COPY packages/ packages/
COPY apps/api/ apps/api/

EXPOSE 4000

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD node -e "fetch('http://localhost:4000/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"

USER node

WORKDIR /app/apps/api
CMD ["tsx", "src/index.ts"]