Dockerfile.orchestrator

# NanoClaw Orchestrator
# Runs the orchestrator (Telegram bot, message router, credential proxy)
# inside a container, spawning sibling agent containers via Docker socket.

FROM node:22-slim

# Install Docker CLI and build tools for native modules (better-sqlite3)
RUN apt-get update && apt-get install -y \
    docker.io \
    python3 \
    make \
    g++ \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Copy package files for caching
COPY package*.json ./

# Install all deps (need devDependencies for tsc, native modules need build tools)
ENV HUSKY=0
RUN npm install

# Copy source and build TypeScript
COPY src/ ./src/
COPY tsconfig.json ./
RUN npx tsc

# Copy container config (skills, build script, Dockerfile for agent image)
COPY container/ ./container/

# Install tessl CLI and host-side tools
RUN npm install -g tessl && tessl --version

# Scripts (promote-from-orchestrator, etc.)
COPY scripts/ ./scripts/

# Tessl workspace — tile dependencies tracked in git, installed at deploy time
COPY tessl-workspace/tessl.json /app/tessl-workspace/tessl.json

# Copy group templates (used by registerGroup to create CLAUDE.md for new groups)
COPY groups/main/CLAUDE.md ./groups/main/CLAUDE.md
COPY groups/global/CLAUDE.md ./groups/global/CLAUDE.md
COPY groups/global/CLAUDE-untrusted.md ./groups/global/CLAUDE-untrusted.md
COPY groups/global/SOUL-untrusted.md ./groups/global/SOUL-untrusted.md

# Remove devDependencies after build
RUN npm prune --omit=dev

# Git safe.directory for bind-mounted repos (backup-repo owned by host user)
RUN git config --global --add safe.directory '*'

# Data directories (store/, data/, groups/, logs/) are bind-mounted at runtime.
# The .env file is also mounted at runtime — never baked into the image.

EXPOSE 3001

CMD ["node", "dist/index.js"]