# syntax=docker/dockerfile:1

#

# Debug variant of Dockerfile: builds an unoptimized binary for faster local

# iteration (`make docker-run-dev`). Same stages as the release Dockerfile, but

# `cargo build` runs without --release, so there is no LTO/opt cost and no need

# for the release memory tuning. Use the release Dockerfile for anything shipped.

#

# base → Rust toolchain + native build dependencies

# chef → base + cargo-chef (dependency caching)

# code → source tree, test targets stripped for binary-only builds

# planner → cargo-chef recipe (dependency graph)

# cacher → compiled dependencies (cached layer)

# builder → the debug binary

# www → the dashboard build (Node)

# runtime → final image: debug binary + dashboard, non-root

#

# Build: docker build -t agent-gateway:local-dev -f Dockerfile.dev .

# Run: make docker-run-dev

ARG NODE_VERSION=22.21.1

ARG RUST_VERSION=1.95.0

###############################################################################

# base — Rust toolchain + native build dependencies

# https://github.com/rust-lang/docker-rust/blob/master/stable/bookworm/slim/Dockerfile

###############################################################################

FROM rust:${RUST_VERSION}-slim-bookworm AS base

RUN apt-get update && apt-get install -y --no-install-recommends \

# needed by the latest affinidi-tdk-rs

build-essential \

libdbus-1-dev \

libssl-dev \

git \

# sasl2-sys

libsasl2-2 \

libsasl2-dev \

libsasl2-modules \

# rdkafka-sys

cmake \

libcurl4-openssl-dev \

# libxml (samael dependency)

libxml2-dev \

libxmlsec1-dev \

# xmlsec1 CLI (SAML response signature verification at runtime)

xmlsec1 \

# bindgen (samael dependency)

libclang-dev \

pkg-config \

# pulsar

protobuf-compiler \

&& rm -rf /var/lib/apt/lists/*

###############################################################################

# chef — base + cargo-chef for dependency caching

###############################################################################

FROM base AS chef

WORKDIR /app

RUN cargo install cargo-chef

###############################################################################

# code — source tree (test targets stripped for binary-only builds)

###############################################################################

FROM base AS code

WORKDIR /app

COPY src/ ./src

COPY Cargo.* ./

# cargo-chef doesn't create stubs for [[test]] targets with harness=false,

# causing manifest parsing to fail. Strip them so tests are not needed for the

# binary.

RUN sed -i '/^\[\[test\]\]/,/^$/d' Cargo.toml

###############################################################################

# planner — compute the cargo-chef dependency recipe

###############################################################################

FROM chef AS planner

WORKDIR /app

COPY --from=code /app .

RUN cargo chef prepare --bin agent-gateway --recipe-path recipe.json

###############################################################################

# cacher — cook (compile) dependencies as a cached layer (debug profile)

###############################################################################

FROM chef AS cacher

WORKDIR /app

COPY --from=planner /app/recipe.json recipe.json

RUN cargo chef cook --bin agent-gateway --recipe-path recipe.json

###############################################################################

# builder — build the debug binary against the cached dependencies

###############################################################################

FROM base AS builder

WORKDIR /app

COPY --from=code /app .

COPY --from=cacher /app/target target

COPY --from=cacher /usr/local/cargo /usr/local/cargo

RUN cargo build --bin agent-gateway --frozen

###############################################################################

# www — build the dashboard

###############################################################################

FROM node:${NODE_VERSION}-bookworm AS www

ARG WWW_DIR=www/default

WORKDIR /app/www

COPY ${WWW_DIR}/public/ ./public

COPY ${WWW_DIR}/src/ ./src

COPY ${WWW_DIR}/build.sh ./

COPY ${WWW_DIR}/package.json ./

COPY ${WWW_DIR}/package-lock.json ./

COPY ${WWW_DIR}/tsconfig.json ./

COPY ${WWW_DIR}/craco.config.js ./

RUN ./build.sh

###############################################################################

# runtime — final image: debug binary + dashboard, running as a non-root user

###############################################################################

FROM base AS runtime

# Drop git and install the curl the healthcheck / bootstrap needs.

RUN apt-get update \

&& apt-get -y remove git git-man \

&& apt-get install -y --no-install-recommends curl \

&& apt-get -y autoclean && apt-get -y clean \

&& rm -rf /var/lib/apt/lists/*

WORKDIR /app

COPY --from=builder /app/target/debug/agent-gateway /usr/local/bin/

COPY --from=www /app/www/build/ /app/www/

COPY scripts/certs/generate-cert.sh /usr/local/bin/

# Create the writable storage directory and a non-root user that owns it, so a

# mounted storage volume is writable without an external chown step.

RUN groupadd -r lowPrivGroup && useradd -r -g lowPrivGroup lowPrivUser \

&& mkdir -p /app/_storage \

&& chown -R lowPrivUser:lowPrivGroup /app/_storage

USER lowPrivUser

ENTRYPOINT ["/usr/local/bin/agent-gateway"]

CMD ["--config", "/app/config/config.toml"]