drop/Dockerfile

# syntax=docker/dockerfile:1

# Pinned to bookworm so the glibc here matches the torrential build stage
# and the libarchive runtime package is named `libarchive13` (trixie renames it to libarchive13t64).
FROM node:lts-bookworm-slim AS base
ENV PNPM_HOME="/pnpm"
ENV PATH="$PNPM_HOME:$PATH"
RUN corepack enable
WORKDIR /app

## so corepack knows pnpm's version
COPY . .
## prevent prompt to download
ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
## setup for offline
RUN corepack pack
## don't call out to network anymore
ENV COREPACK_ENABLE_NETWORK=0

### INSTALL DEPS ONCE
FROM base AS deps
RUN pnpm install --frozen-lockfile --ignore-scripts

### BUILD TORRENTIAL
# Bookworm-pinned to match the runtime image's glibc (a trixie build would not run on bookworm).
FROM rustlang/rust:nightly-bookworm-slim AS torrential-build
## libarchive-dev + pkg-config let libarchive3-sys link libarchive dynamically (glibc).
## protobuf-compiler is kept for parity (torrential's build.rs uses a vendored protoc).
RUN apt-get update && apt-get install -y --no-install-recommends \
    pkg-config \
    libarchive-dev \
    protobuf-compiler \
    && rm -rf /var/lib/apt/lists/*
WORKDIR /build
COPY . .
## Network resilience on hosts with poor/bursty throughput to crates.io:
## observed on .88 (~11KB/s, transfers occasionally stalling near-zero for
## tens of seconds) -- cargo's libcurl transport aborts a download once it
## sees less than CARGO_HTTP_LOW_SPEED_LIMIT bytes/sec for
## CARGO_HTTP_LOW_SPEED_TIMEOUT seconds (curl default: 10 bytes/s over 30s),
## which a merely-slow-but-alive connection can trip. A from-scratch build
## on such a host burned ~50 minutes downloading crates before one transfer
## exhausted CARGO_NET_RETRY's default 3 attempts and hard-failed the whole
## build (`failed to download from .../libc/0.2.178/download`, exit 101).
## Lower the low-speed floor so a trickling-but-live transfer isn't treated
## as dead, raise the retry budget, and give sparse-index/registry
## operations a longer ceiling before giving up outright.
ENV CARGO_HTTP_LOW_SPEED_LIMIT=1
ENV CARGO_HTTP_LOW_SPEED_TIMEOUT=120
ENV CARGO_NET_RETRY=10
ENV CARGO_HTTP_TIMEOUT=600
ENV CARGO_HTTP_MULTIPLEXING=false
## Resource-pressure cap: bound cargo's parallel job count on a
## memory-contended host. Empty (default) leaves CARGO_BUILD_JOBS unset, so
## cargo falls back to its own CPU-count autodetect -- pass
## --build-arg CARGO_JOBS=2 to constrain it. Rust codegen units are
## memory-hungry per job running in parallel; this is the Rust-side twin of
## SKIP_TYPECHECK below.
ARG CARGO_JOBS=""
## Persistent cache mounts for the registry index/downloads and the
## target/ build dir: any change ANYWHERE in the repo invalidates the
## `COPY . .` above (and therefore this RUN layer) on every build, so
## without these every single build re-downloads and recompiles every
## crate from zero -- the ~50-minute cost that motivated the network
## hardening above, paid again on every future commit. Cache mounts
## live in the buildx cache store, not the image layer, so they survive
## across builds regardless of layer invalidation. sharing=locked
## because this builder can run more than one image build at a time.
## Cache mounts are NOT part of the final layer filesystem, so the
## compiled binary is copied out to a stable (non-cached) path before
## the mount unwinds -- see the run-system stage's COPY --from below,
## which reads /build/torrential-bin, not target/release/torrential
## directly.
RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
    --mount=type=cache,target=/build/torrential/target,sharing=locked \
    if [ -n "$CARGO_JOBS" ]; then export CARGO_BUILD_JOBS="$CARGO_JOBS"; fi; \
    cargo build --release --manifest-path ./torrential/Cargo.toml && \
    cp ./torrential/target/release/torrential /build/torrential-bin

### BUILD APP
FROM base AS build-system

ENV NODE_ENV=production
ENV NUXT_TELEMETRY_DISABLED=1

## add git so drop can determine its git ref at build
RUN apt-get update && apt-get install -y --no-install-recommends git \
    && rm -rf /var/lib/apt/lists/*

## copy deps and rest of project files
COPY . .
COPY --from=deps /app/node_modules ./node_modules


ARG BUILD_DROP_VERSION
ARG BUILD_GIT_REF

## Resource-pressure escape hatch (see nuxt.config.ts's typescript.typeCheck
## comment): --build-arg SKIP_TYPECHECK=true skips vue-tsc's full-project
## typecheck, the single most memory-hungry step of `nuxt build`, for
## building on a host that's already near its memory limit. Off by default.
ARG SKIP_TYPECHECK=false
ENV NUXT_BUILD_SKIP_TYPECHECK=$SKIP_TYPECHECK

## Resource-pressure cap: bound Node's old-space heap for the
## postinstall/build step (Vite/Rolldown/vue-tsc are all Node processes).
## Empty (default) leaves NODE_OPTIONS unset, i.e. Node's own default heap
## sizing -- pass --build-arg NODE_MAX_OLD_SPACE=4096 to constrain it.
ARG NODE_MAX_OLD_SPACE=""
ENV NODE_OPTIONS=""
RUN if [ -n "$NODE_MAX_OLD_SPACE" ]; then export NODE_OPTIONS="--max-old-space-size=$NODE_MAX_OLD_SPACE"; fi; \
    pnpm run --filter=drop postinstall && pnpm run --filter=drop build


# create run environment for Drop
FROM base AS run-system

ENV NODE_ENV=production
ENV NUXT_TELEMETRY_DISABLED=1

# The base stage's `COPY . .` puts the whole repo into the runtime WORKDIR (/app),
# but at runtime only the artifacts copied explicitly below are needed. Drop the
# inherited `torrential` source dir: the service resolves the binary by scanning
# the cwd for `torrential`, and a directory there is spawned as ./torrential and
# fails with EACCES. With it gone, resolution falls through to the `torrential`
# binary installed on PATH (/usr/bin/torrential) below.
RUN rm -rf /app/torrential

# RUN --mount=type=cache,target=/root/.yarn YARN_CACHE_FOLDER=/root/.yarn yarn add --network-timeout 1000000 --no-lockfile --ignore-scripts prisma@6.11.1
## runtime deps:
##  - libarchive13: torrential now links libarchive dynamically (glibc build)
##  - p7zip-full: provides the 7z CLI
##  - nginx: front-end proxy
##  - openssl + ca-certificates: required by Prisma's query engine on Debian
## pnpm itself is provided by corepack (enabled in the base stage)
RUN apt-get update && apt-get install -y --no-install-recommends \
    libarchive13 \
    p7zip-full \
    nginx \
    openssl \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*
RUN pnpm install prisma@7.7.0 --global
# init prisma to download all required files
RUN pnpm prisma init

COPY --from=build-system /app/server/prisma.config.ts ./
COPY --from=build-system /app/server/.output ./app
COPY --from=build-system /app/server/prisma ./prisma
COPY --from=build-system /app/server/build ./startup
COPY --from=build-system /app/server/build/nginx.conf /nginx.conf
COPY --from=torrential-build /build/torrential-bin /usr/bin/torrential

ENV LIBRARY="/library"
ENV DATA="/data"
ENV NGINX_CONFIG="/nginx.conf"
# Nuxt's port
ENV PORT=4000

CMD ["sh", "/app/startup/launch.sh"]