Dockerfile

# Build stage 1: Frontend
FROM node:20-bookworm-slim AS frontend-builder

WORKDIR /app/frontend

# Copy frontend package files
COPY frontend/package*.json ./

# Install dependencies
RUN npm ci --legacy-peer-deps

# Copy frontend source
COPY frontend/ ./

# Build frontend
RUN npm run build

# Build stage 2: Go binary
FROM golang:1.24-bookworm AS go-builder

# Install build dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    git ca-certificates tzdata \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Copy go mod files first for better caching
COPY go.mod go.sum ./
RUN go mod download

# Copy source code
COPY cmd/ ./cmd/
COPY internal/ ./internal/
COPY assets/ ./assets/
COPY docs/ ./docs/

# Copy built frontend from previous stage
COPY --from=frontend-builder /app/frontend/dist ./assets/frontend/

# Build arguments for multi-platform support
ARG TARGETOS=linux
ARG TARGETARCH

# Build the binary for target platform
RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \
    -ldflags="-s -w -X main.Version=docker" \
    -o /app/web-cli \
    ./cmd/web-cli

# Final stage: Debian-based runtime for proper bash support
FROM debian:bookworm-slim

# Install required packages:
# - ca-certificates: for HTTPS connections
# - tzdata: for timezone support
# - bash: full bash shell for script execution
# - coreutils: standard Unix utilities
# - curl: for health checks and HTTP operations
# - openssh-client: for SSH connections to remote servers
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    tzdata \
    bash \
    zsh \
    coreutils \
    curl \
    openssh-client \
    && rm -rf /var/lib/apt/lists/* \
    && apt-get clean

# Create non-root user for security
# Add user to tty group for PTY access (required for interactive terminal)
RUN groupadd -g 1000 webcli && \
    useradd -u 1000 -g webcli -G tty -s /bin/bash -m webcli

# Create data and config directories
RUN mkdir -p /data /config && \
    chown -R webcli:webcli /data /config

# Create .ssh directory for SSH key operations
RUN mkdir -p /home/webcli/.ssh && \
    chown webcli:webcli /home/webcli/.ssh && \
    chmod 700 /home/webcli/.ssh

# Create tmp directory for session files (SSH configs, keys, wrappers)
# This ensures the non-root user can create temp files for terminal sessions
RUN mkdir -p /home/webcli/tmp && \
    chown webcli:webcli /home/webcli/tmp && \
    chmod 700 /home/webcli/tmp

WORKDIR /app

# Copy binary from builder
COPY --from=go-builder /app/web-cli /app/web-cli

# Copy healthcheck script
COPY scripts/healthcheck.sh /app/healthcheck.sh

# Set ownership
RUN chown webcli:webcli /app/web-cli /app/healthcheck.sh && \
    chmod +x /app/healthcheck.sh

# Switch to non-root user
USER webcli

# Expose default port
EXPOSE 7777

# Health check using script (auto-detects http/https based on TLS config)
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
    CMD ["/app/healthcheck.sh"]

# Environment variables with defaults
# Note: WEBCLI_ENCRYPTION_KEY_PATH is a file path to the key file, not the secret itself
# TMPDIR is set to user's home for proper temp file creation in non-root context
# hadolint ignore=DL3044
ENV WEBCLI_PORT=7777 \
    WEBCLI_HOST=0.0.0.0 \
    WEBCLI_DATABASE_PATH=/data/web-cli.db \
    WEBCLI_ENCRYPTION_KEY_PATH=/data/.encryption_key \
    TMPDIR=/home/webcli/tmp \
    SHELL=/bin/bash

# Volume for persistent data
VOLUME ["/data", "/config"]

# Run the application
ENTRYPOINT ["/app/web-cli"]