Dockerfile.erb

# syntax=docker/dockerfile:1
# check=error=true
<% if using_kamal? -%>

# This Dockerfile is designed for production, not development. Use with Kamal or build'n'run by hand:
# docker build -t demo .
# docker run -d -p 80:80 -e RAILS_MASTER_KEY=<value from config/master.key> --name demo demo

# For a containerized dev environment, see Dev Containers: https://guides.rubyonrails.org/getting_started_with_devcontainer.html
<% end -%>

# Make sure RUBY_VERSION matches the Ruby version in <%= ruby_version_file || '.ruby-version' %>
ARG RUBY_VERSION=<%= RUBY_VERSION %>
<% if api_client_dir -%>
<%= render partial: 'node_client' %>


<% end -%>
<% if options.fullstaq -%>
FROM <%= platform %>quay.io/evl.ms/fullstaq-ruby:${RUBY_VERSION}-<%= options.jemalloc ? 'jemalloc-' : 'malloctrim-' %><%= variant %><% unless options.precompile == "defer" %> AS base<% end %>
<% elsif options.hardened -%>
FROM <%= platform %>dhi.io/ruby:$RUBY_VERSION-dev<% unless options.precompile == "defer" %> AS base<% end %>
<% else -%>
FROM <%= platform %><%= options.registry %>ruby:$RUBY_VERSION-<%= variant %><% unless options.precompile == "defer" %> AS base<% end %>
<% end -%>

<% unless options.label.empty? -%>
<% options.label.each do |key, value| -%>
LABEL <%= key =~ /^\w[.\w]*$/ ? key : key.inspect %>=<%= value.inspect %>
<% end -%>

<% end -%>
# Rails app lives here
WORKDIR /rails

<% unless base_args.empty? -%>
# Base build arguments
ARG <%= base_args.map {|key, value| "#{key}=#{value.inspect}"}.join(" \\\n    ") %>

<% end -%>
# Update gems and bundler
RUN gem update --system <% if RUBY_VERSION.start_with? '2' %>3.4.22 <% end %>--no-document && \
    gem install -N <%= base_gems.join(" ") %>

<% unless base_packages.empty? -%>
# Install base packages<% unless base_requirements.empty? -%> needed to install <%= base_requirements %><% end %>
<%= render partial: 'apt_install', locals: {packages: base_packages, clean: true, repos: base_repos} %>

<% end -%>
# Set production environment
ENV <%= base_env.join(" \\\n    ") %>

<% if using_execjs? and node_version != 'lts' -%>
<%= render partial: 'install_node', locals: {yarn_version: nil} %>

<% end -%>
<% if base_instructions -%>
<%= base_instructions %>

<% end -%>
<% unless options.precompile == "defer" -%>

# Throw-away build stage<%= parallel? ? 's' : '' %> to reduce size of final image
FROM base AS <%= parallel? ? 'pre' : '' %>build

<% end -%>
# Install packages needed to build gems<%= using_node? ? " and node modules" : "" %>
<%= render partial: 'apt_install', locals: {packages: build_packages, clean: true, repos: ''} %>

<% if parallel? -%>

FROM prebuild AS <% if using_bun? %>bun<% else %>node<% end %>

<% end -%>
<% if using_bun? and (!using_execjs? || File.exist?('bun.lockb') || File.exist?('bun.lock')) -%>
<%= render partial: 'install_node', locals: {bun_version: using_execjs? ? nil : bun_version} %>

<% elsif using_node? and (!using_execjs? || File.exist?('yarn.lock')) -%>
<%= render partial: 'install_node', locals: {node_version: using_execjs? ? nil : node_version, yarn_version: File.exist?('yarn.lock') ? yarn_version : nil} %>

<% end -%>
<% if parallel? -%>
<%= render partial: 'npm_install', locals: {sources: Dir[*%w(package.json yarn.lock bun.lockb bun.lock)]} %>


FROM prebuild AS build

<% end -%>
<% unless build_args.empty? -%>
# Build arguments
ARG <%= build_args.map {|key, value| "#{key}=#{value.inspect}"}.join(" \\\n    ") %>

<% end -%>
<% unless build_env.empty? -%>
# Build options
ENV <%= build_env.join(" \\\n    ") %>

<% end -%>
# Install application gems
COPY<% if options.link? %> --link<% end %> Gemfile Gemfile.lock <% if references_ruby_version_file? %><%= ruby_version_file %> <% end %>./
<% if options.nproc > 1 -%>
ENV MAKE="make -j<%= options.nproc %>"
<% end -%>
<% if @netpopbug && Rails.env != "test" -%>
RUN sed -i "/net-pop (0.1.2)/a\      net-protocol" Gemfile.lock
<% end -%>
<% if options.cache? -%>
RUN --mount=type=cache,id=bld-gem-cache,sharing=locked,target=/srv/vendor \
<% if private_gemserver_env_variable_name -%>
    --mount=type=secret,id=gemserver_credentials,target=/kaniko/gemserver_credentials \
    <%= private_gemserver_env_variable_name %>="$(cat /kaniko/gemserver_credentials)" && \
    export <%= private_gemserver_env_variable_name %> && \
<% end -%>
    bundle config set app_config .bundle && \
    bundle config set path /srv/vendor && \
    bundle install && \
<% if depend_on_bootsnap? && options.precompile != "defer" -%>
    bundle exec bootsnap precompile --gemfile && \
<% end -%>
    bundle clean && \
    mkdir -p vendor && \
    bundle config set path vendor && \
    cp -ar /srv/vendor .

<% else -%>
<% if private_gemserver_env_variable_name -%>
RUN --mount=type=secret,id=gemserver_credentials,target=/kaniko/gemserver_credentials \
    <%= private_gemserver_env_variable_name %>="$(cat /kaniko/gemserver_credentials)" && \
    export <%= private_gemserver_env_variable_name %> && \
    bundle install && \
<% else -%>
RUN <% if options["precompiled-gems"] != true %>bundle config set force_ruby_platform true && \<%= "\n    " %><% end %>bundle install && \
<% end -%>
    rm -rf ~/.bundle/ "${BUNDLE_PATH}"/ruby/*/cache "${BUNDLE_PATH}"/ruby/*/bundler/gems/*/.git<% if depend_on_bootsnap? && options.precompile != "defer" -%> && \
    bundle exec bootsnap precompile --gemfile<% end %>

<% end -%>
<% if using_passenger? -%>
# Compile passenger native support
RUN passenger-config build-native-support

<% end -%>
<% if parallel? -%>
<% if using_bun? -%>
# Copy bun modules
COPY --from=bun /rails/node_modules /rails/node_modules
COPY --from=bun /usr/local/bun /usr/local/bun
ENV PATH=/usr/local/bun/bin:$PATH
<% else -%>
# Copy node modules
COPY --from=node /rails/node_modules /rails/node_modules
COPY --from=node /usr/local/node /usr/local/node
ENV PATH=/usr/local/node/bin:$PATH
<% end -%>

<% elsif using_node? || using_bun? -%>
<%= render partial: 'npm_install', locals: {sources: Dir[*%w(.npmrc .yarnrc .yarnrc.yml package.json package-lock.json yarn.lock bun.lockb bun.lock)]} %>

<% end -%>
# Copy application code
COPY<% if options.link? %> --link<% end %> . .

<% if build_instructions -%>
<%= build_instructions %>

<% end -%>
<% if depend_on_bootsnap? -%>
# Precompile bootsnap code for faster boot times
RUN bundle exec bootsnap precompile app/ lib/

<% end -%>
<% unless binfile_fixups.empty? -%>
<% if options['bin-cd'] and binfile_fixups.length == 1 -%>
# Adjust binfiles to set current working directory
<% else -%>
# Adjust binfiles to be executable on Linux<%= options['bin-cd'] ? ' and set current working directory' : '' %>
<% end -%>
<%= "RUN " + binfile_fixups.join(" && \\\n    ") %>

<% end -%>
<% unless options.precompile == "defer" -%>
<% if Dir.exist?('app/assets') and !api_only? -%>
# Precompiling assets for production without requiring secret RAILS_MASTER_KEY
RUN SECRET_KEY_BASE<%= Rails::VERSION::MAJOR<7 || Rails::VERSION::STRING.start_with?('7.0') ? '=DUMMY' : '_DUMMY=1' %> ./bin/rails assets:precompile

<% end -%>

# Final stage for app image
FROM base

<% end -%>
<% if using_litefs? -%>
# Install, configure litefs
COPY --from=flyio/litefs:0.5 /usr/local/bin/litefs /usr/local/bin/litefs
COPY<% if options.link? %> --link<% end %> config/litefs.yml /etc/litefs.yml

<% end -%>
<% unless deploy_args.empty? -%>
# Deployment build arguments
ARG <%= deploy_args.map {|key, value| "#{key}=#{value.inspect}"}.join(" \\\n    ") %>

<% end -%>
<% unless deploy_packages.empty? -%>
# Install packages needed for deployment
<%= render partial: 'apt_install', locals: {packages: deploy_packages, clean: true, repos: deploy_repos} %>
<% end -%>

<% if using_passenger? -%>
<%= render partial: 'passenger' %>

<% elsif options.nginx? -%>
<%= render partial: 'nginx' %>

<% elsif procfile.size > 1 -%>
RUN gem install foreman

<% end -%>
<% unless options.precompile == "defer" -%>
# Copy built artifacts: gems, application
COPY --from=build "${BUNDLE_PATH}" "${BUNDLE_PATH}"
COPY --from=build /rails /rails
<% if using_passenger? -%>

# Copy passenger native support
COPY --from=build /root/.passenger/native_support /root/.passenger/native_support
<% end -%>
<% if api_client_dir -%>

# Copy built client
COPY --from=client /rails/<%= api_client_dir %>/build /rails/public
<% end -%>

<% end -%>
<% if run_as_root? -%>
<% if deploy_database == 'sqlite3' -%>
RUN mkdir /data
<% end -%>
<% else -%>
# Run and own only the runtime files as a non-root user for security
<% if options.compose? -%>
<% user = "rails:rails" -%>
ARG UID=1000 \
    GID=1000
<% if options.alpine? -%>
RUN addgroup --system --gid $GID rails && \
    adduser --system rails --uid $UID --ingroup rails --home /home/rails --shell /bin/sh rails && \
<% else -%>
RUN groupadd -f -g $GID rails && \
    useradd -u $UID -g $GID rails --create-home --shell /bin/bash && \
<% end -%>
<% else -%>
<% user = "1000:1000" -%>
<% if options.alpine? -%>
RUN addgroup --system --gid 1000 rails && \
    adduser --system rails --uid 1000 --ingroup rails --home /home/rails --shell /bin/sh rails && \
<% else -%>
RUN groupadd --system --gid 1000 rails && \
    useradd rails --uid 1000 --gid 1000 --create-home --shell /bin/bash && \
<% end -%>
<% end -%>
<% if options.nginx? -%>
    chown <%= user %> /var/lib/nginx /var/log/nginx/* && \
<% end -%>
<% if deploy_packages.include?("sudo") && options.sudo? -%>
    sed -i 's/env_reset/env_keep="*"/' /etc/sudoers && \
<% end -%>
<% if deploy_database == 'sqlite3' -%>
    mkdir /data<% if using_litefs? %> /litefs<% end %> && \
    chown -R <%= user %> <%= Dir[*%w(db log storage tmp)].join(" ") %> /data<% if using_litefs? %> /litefs<% end %>
<% else -%>
    chown -R <%= user %> <%= Dir[*%w(db log storage tmp)].join(" ") %>
<% end -%>
<% unless options.swap? or using_passenger? or using_litefs? -%>
USER <%= user %>
<% end -%>

<% end -%>
<% if deploy_instructions -%>
<%= deploy_instructions.strip %>

<% end -%>
<% if using_litefs? and !run_as_root? -%>
# Authorize rails user to launch litefs
COPY <<-"EOF" /etc/sudoers.d/rails
rails ALL=(root) /usr/local/bin/litefs
EOF

<% end -%>
<% unless deploy_env.empty? -%>
# Deployment options
ENV <%= deploy_env.join(" \\\n    ") %>

<% end -%>
<% if options.prepare -%>
# Entrypoint prepares the database.
<% else -%>
# Entrypoint sets up the container.
<% end -%>
<% if using_litefs? -%>
ENTRYPOINT ["litefs", "mount"]
<% else -%>
ENTRYPOINT ["/rails/bin/docker-entrypoint"]
<% end -%>

<% if procfile.size > 1 -%>
# Build a Procfile for production use
COPY <<-"EOF" /rails/Procfile.prod
<% procfile.each do |name, command| -%>
<%= name %>: <%= command %>
<% end -%>
EOF

<% end -%>
<% if using_thruster? -%>
# Start server via Thruster by default, this can be overwritten at runtime
<% else -%>
# Start the server by default, this can be overwritten at runtime
<% end -%>
EXPOSE <%= using_thruster? ? '80' : '3000' %>
<% if deploy_database == 'sqlite3' -%>
VOLUME /data
<% end -%>
<% unless fly_processes && !using_thruster? -%>
<% if !options.procfile.blank? -%>
CMD ["foreman", "start", "--procfile=<%= options.procfile %>"]
<% elsif procfile.size > 1 -%>
CMD ["foreman", "start", "--procfile=Procfile.prod"]
<% elsif !using_litefs? -%>
CMD <%= procfile.values.first.split(" ").inspect %>
<% end -%>
<% end -%>