Dockerfile-local

# syntax=docker/dockerfile:1.12

ARG NODE_IMAGE=node@sha256:80f12a4030a00d8f78ebc4602bc3ef0f984932f498649b8ed3c0a740a6dff4a8
ARG RUNTIME_IMAGE=gcr.io/distroless/base-nossl-debian13@sha256:8c563c1fb5e120606f0d85733049775faed6192e2bd2223ef283a5393eec22b9

FROM ${NODE_IMAGE} AS toolchain

ARG IOTERAX_NPM_REGISTRY=https://npm.pkg.github.com
ENV IOTERAX_NPM_REGISTRY=${IOTERAX_NPM_REGISTRY}

WORKDIR /app

COPY .yarn/releases/yarn-4.18.0.cjs /opt/yarn/yarn.cjs
RUN chmod 0555 /opt/yarn/yarn.cjs && ln -s /opt/yarn/yarn.cjs /usr/local/bin/yarn

RUN set -eu; \
    mkdir -p /node-runtime/usr/local/lib /node-runtime/var/lib/dpkg/status.d; \
    for library in libatomic.so.1 libgcc_s.so.1 libstdc++.so.6; do \
      library_path="$(ldconfig -p | sed -n "/^[[:space:]]*${library} / { s/.*=> //; p; q; }")"; \
      test -n "${library_path}"; \
      cp --dereference "${library_path}" "/node-runtime/usr/local/lib/${library}"; \
    done; \
    for package in libatomic1 libgcc-s1 libstdc++6; do \
      dpkg-query --status "${package}" > "/node-runtime/var/lib/dpkg/status.d/${package}"; \
    done; \
    node --version | grep -Fx 'v26.6.0'

COPY .yarn/patches ./.yarn/patches
COPY package.json yarn.lock tsconfig.json nest-cli.json register-path-alias.cjs ./
COPY scripts/docker/prepare-dependency-channel.cjs ./scripts/docker/prepare-dependency-channel.cjs
COPY scripts/docker/install-dependency-channel.sh ./scripts/docker/install-dependency-channel.sh

RUN printf '%s\n' \
    'nodeLinker: pnp' \
    'pnpMode: strict' \
    'enableGlobalCache: false' \
    'enableImmutableInstalls: false' \
    'enableScripts: false' \
    'globalFolder: /yarn/global' \
    'networkConcurrency: 16' \
    'npmAuditRegistry: "https://registry.npmjs.org"' \
    'npmRegistryServer: "https://registry.npmjs.org"' \
    'npmScopes:' \
    '  ioterax:' \
    '    npmRegistryServer: "${IOTERAX_NPM_REGISTRY}"' \
    '    npmAlwaysAuth: true' \
    '    npmAuthToken: "${YARN_NPM_AUTH_TOKEN-}"' \
    > .yarnrc.yml

RUN IOTERAX_DEPENDENCY_CHANNEL=local node scripts/docker/prepare-dependency-channel.cjs

FROM toolchain AS builder

RUN --mount=type=cache,id=api-region-yarn-global,target=/yarn/global,sharing=locked \
    --mount=type=secret,id=ioterax_npm_token,required=true \
    YARN_NPM_AUTH_TOKEN="$(cat /run/secrets/ioterax_npm_token)" \
    IOTERAX_DEPENDENCY_CHANNEL=local \
    sh scripts/docker/install-dependency-channel.sh full

COPY src ./src
RUN yarn build

FROM toolchain AS production-dependencies

RUN --mount=type=cache,id=api-region-yarn-global,target=/yarn/global,sharing=locked \
    --mount=type=secret,id=ioterax_npm_token,required=true \
    YARN_NPM_AUTH_TOKEN="$(cat /run/secrets/ioterax_npm_token)" \
    IOTERAX_DEPENDENCY_CHANNEL=local \
    sh scripts/docker/install-dependency-channel.sh production

FROM ${RUNTIME_IMAGE} AS runtime

ENV NODE_ENV=local \
    SERVICE_NAME=api-region \
    LISTEN_PORT=3903 \
    MONGODB_DATABASE=foundation_central \
    LD_LIBRARY_PATH=/usr/local/lib \
    NODE_OPTIONS="--enable-source-maps --require=/app/.pnp.cjs --require=/app/register-path-alias.cjs"

WORKDIR /app

COPY --from=toolchain /usr/local/bin/node /usr/local/bin/node
COPY --from=toolchain /node-runtime/ /
COPY --from=production-dependencies --chown=65532:65532 /app/package.json ./package.json
COPY --from=production-dependencies --chown=65532:65532 /app/.pnp.cjs ./.pnp.cjs
COPY --from=production-dependencies --chown=65532:65532 /app/.pnp.loader.mjs ./.pnp.loader.mjs
COPY --from=production-dependencies --chown=65532:65532 /app/.yarn/cache ./.yarn/cache
COPY --from=builder --chown=65532:65532 /app/register-path-alias.cjs ./register-path-alias.cjs
COPY --from=builder --chown=65532:65532 /app/dist ./dist

USER 65532:65532
EXPOSE 3903
HEALTHCHECK --interval=30s --timeout=3s --start-period=20s --retries=3 \
  CMD ["/usr/local/bin/node", "-e", "fetch('http://127.0.0.1:'+(process.env.PORT||process.env.LISTEN_PORT||'3903')+'/health/live').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
ENTRYPOINT ["/usr/local/bin/node"]
CMD ["dist/main.js"]