Dockerfile

FROM node:22-bookworm

# Install Bun (required for build scripts)
RUN curl -fsSL https://bun.sh/install | bash
ENV PATH="/root/.bun/bin:${PATH}"

# Pre-install common tools for skills
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
    ffmpeg \
    python3 python3-pip python3-venv \
    jq \
    postgresql-client \
    default-mysql-client \
    redis-tools \
    curl wget \
    gnupg \
  && apt-get clean && rm -rf /var/lib/apt/lists/*

# GitHub CLI
RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
      | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \
  && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
      > /etc/apt/sources.list.d/github-cli.list \
  && apt-get update && apt-get install -y gh \
  && apt-get clean && rm -rf /var/lib/apt/lists/*

# kubectl (pinned version to avoid flaky dl.k8s.io/release/stable.txt lookups)
ARG KUBECTL_VERSION=v1.35.0
RUN curl -fsSL "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/$(dpkg --print-architecture)/kubectl" \
      -o /usr/local/bin/kubectl \
  && chmod +x /usr/local/bin/kubectl

# AWS CLI v2
RUN curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o /tmp/awscli.zip \
  && unzip -q /tmp/awscli.zip -d /tmp \
  && /tmp/aws/install \
  && rm -rf /tmp/aws /tmp/awscli.zip

# Azure CLI
RUN curl -fsSL https://aka.ms/InstallAzureCLIDeb | bash \
  && apt-get clean && rm -rf /var/lib/apt/lists/*

# Terraform
RUN curl -fsSL https://apt.releases.hashicorp.com/gpg | gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg \
  && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com bookworm main" \
      > /etc/apt/sources.list.d/hashicorp.list \
  && apt-get update && apt-get install -y terraform \
  && apt-get clean && rm -rf /var/lib/apt/lists/*

RUN corepack enable

WORKDIR /app

ARG THINKFLEETBOT_DOCKER_APT_PACKAGES=""
RUN if [ -n "$THINKFLEETBOT_DOCKER_APT_PACKAGES" ]; then \
      apt-get update && \
      DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends $THINKFLEETBOT_DOCKER_APT_PACKAGES && \
      apt-get clean && \
      rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*; \
    fi

COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
COPY ui/package.json ./ui/package.json
COPY patches ./patches
COPY scripts ./scripts

RUN pnpm install --frozen-lockfile

COPY . .
RUN THINKFLEETBOT_A2UI_SKIP_MISSING=1 pnpm build
# Force pnpm for UI build (Bun may fail on ARM/Synology architectures)
ENV THINKFLEETBOT_PREFER_PNPM=1
RUN pnpm ui:install
RUN pnpm ui:build

ENV NODE_ENV=production

# Scoped sudo for Super Bot / developer mode (only apt-get, no full root)
RUN apt-get update && apt-get install -y --no-install-recommends sudo \
  && echo "node ALL=(ALL) NOPASSWD: /usr/bin/apt-get, /usr/bin/apt" >> /etc/sudoers.d/node-apt \
  && chmod 0440 /etc/sudoers.d/node-apt \
  && apt-get clean && rm -rf /var/lib/apt/lists/*

# Dev-install helper for persistent apt packages across restarts
COPY scripts/dev-install.sh /usr/local/bin/dev-install
RUN chmod +x /usr/local/bin/dev-install

# Ensure workspace and config directories exist before switching to non-root user.
# K8s volume mounts may shadow /home/node; pre-creating prevents ENOENT on startup.
RUN mkdir -p /home/node/thinkfleet /home/node/.thinkfleet && \
    chown -R node:node /home/node/thinkfleet /home/node/.thinkfleet

# Security hardening: Run as non-root user
# The node:22-bookworm image includes a 'node' user (uid 1000)
# This reduces the attack surface by preventing container escape via root privileges
USER node

CMD ["node", "dist/index.js"]