mirror of
https://github.com/hanzoai/bot.git
synced 2026-10-30 17:24:26 +00:00
zeekay
8767fe10e2
- Deploy step: switch from doctl/kubectl to Hanzo PaaS webhook (platform.hanzo.ai/api/deploy) matching console pattern - Per-arch builds push only arch-specific tags (main-amd64, main-arm64) to prevent amd64/arm64 from overwriting each other's :latest - Manifest job creates :latest from arch digests with full image refs - CACHE_BUST build arg ensures COPY/build use fresh source each commit
71 lines
2.6 KiB
Docker
71 lines
2.6 KiB
Docker
FROM node:22-bookworm
|
|
|
|
# Install Bun (required for build scripts)
|
|
RUN curl -fsSL https://bun.sh/install | bash
|
|
ENV PATH="/root/.bun/bin:${PATH}"
|
|
|
|
RUN corepack enable
|
|
|
|
WORKDIR /app
|
|
|
|
ARG BOT_DOCKER_APT_PACKAGES=""
|
|
RUN if [ -n "$BOT_DOCKER_APT_PACKAGES" ]; then \
|
|
apt-get update && \
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends $BOT_DOCKER_APT_PACKAGES && \
|
|
apt-get clean && \
|
|
rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*; \
|
|
fi
|
|
|
|
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
|
|
COPY ui/package.json ./ui/package.json
|
|
COPY patches ./patches
|
|
COPY scripts ./scripts
|
|
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
# Optionally install Chromium and Xvfb for browser automation.
|
|
# Build with: docker build --build-arg BOT_INSTALL_BROWSER=1 ...
|
|
# Adds ~300MB but eliminates the 60-90s Playwright install on every container start.
|
|
# Must run after pnpm install so playwright-core is available in node_modules.
|
|
ARG BOT_INSTALL_BROWSER=""
|
|
RUN if [ -n "$BOT_INSTALL_BROWSER" ]; then \
|
|
apt-get update && \
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends xvfb && \
|
|
node /app/node_modules/playwright-core/cli.js install --with-deps chromium && \
|
|
apt-get clean && \
|
|
rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*; \
|
|
fi
|
|
|
|
# CACHE_BUST invalidates all layers below when the commit SHA changes,
|
|
# ensuring COPY and build always use fresh source from the current commit.
|
|
ARG CACHE_BUST=""
|
|
COPY . .
|
|
RUN pnpm build
|
|
|
|
# Ensure memory-lancedb extension dependencies are installed.
|
|
# LanceDB has native bindings that may not be hoisted by pnpm in all configurations.
|
|
RUN pnpm install --filter @hanzo/memory-lancedb --prod --no-frozen-lockfile || true
|
|
# Force pnpm for UI build (Bun may fail on ARM/Synology architectures)
|
|
ENV BOT_PREFER_PNPM=1
|
|
RUN pnpm ui:build
|
|
|
|
ENV NODE_ENV=production
|
|
|
|
# Allow non-root user to write temp files during runtime/tests.
|
|
RUN chown -R node:node /app
|
|
|
|
# Security hardening: Run as non-root user
|
|
# The node:22-bookworm image includes a 'node' user (uid 1000)
|
|
# This reduces the attack surface by preventing container escape via root privileges
|
|
USER node
|
|
|
|
# Support custom init scripts mounted at /bot-init.d/
|
|
# Scripts must be executable. They run before the gateway starts.
|
|
# Example: docker run -v ./my-scripts:/bot-init.d:ro hanzo-bot
|
|
ENTRYPOINT ["/app/scripts/docker-entrypoint.sh"]
|
|
|
|
# Start gateway server with default config.
|
|
# Binds to LAN (0.0.0.0) for container platforms with health checks and ingress.
|
|
# Set BOT_GATEWAY_TOKEN or BOT_GATEWAY_PASSWORD env var for auth.
|
|
CMD ["node", "hanzo-bot.mjs", "gateway", "--allow-unconfigured", "--bind", "lan"]
|