Dockerfile

FROM node:20-bullseye-slim

WORKDIR /app

# Build tools required to compile better-sqlite3's native module.
RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*

# Install dependencies first (better layer caching).
COPY package.json package-lock.json ./
RUN npm ci
RUN npm rebuild better-sqlite3

# Copy the application source.
COPY . .

# Run as the unprivileged built-in 'node' user (uid 1000), not root.
# Ensure the SQLite data directory exists and the app tree is writable by it.
RUN mkdir -p /app/server/data && chown -R node:node /app
USER node

# HTTP dashboard/API.
EXPOSE 3000
# DNS sinkhole runs on an UNPRIVILEGED port inside the container (5353);
# map host 53 -> container 5353 in docker-compose. No root needed.
EXPOSE 5353/udp

ENV NODE_ENV=production

# Liveness: the daemon is healthy when the API answers.
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD node -e "require('http').get('http://127.0.0.1:'+(process.env.PORT||3000)+'/api/health',r=>process.exit(r.statusCode===200?0:1)).on('error',()=>process.exit(1))"

CMD ["npm", "start"]