Dockerfile

# Two build stages so neither toolchain ends up in the runtime image; what ships
# is node_modules for production plus two directories of compiled output.

FROM node:22-alpine AS server-build
WORKDIR /build
COPY package.json package-lock.json* ./
RUN npm install --no-audit --no-fund
COPY tsconfig.json ./
COPY src ./src
RUN npm run build

FROM node:22-alpine AS studio-build
WORKDIR /build
COPY studio/package.json studio/package-lock.json* ./
RUN npm install --no-audit --no-fund
COPY studio/ ./
RUN npm run build

FROM node:22-alpine AS runtime
# vips-tools is libvips' command line, which /storage/v1/render/image invokes to
# resize and re-encode images. It is an apk package rather than an npm one on
# purpose: no npm dependency may be added here, and hand-writing an image codec
# is not a reasonable use of this codebase. vips-heif adds the AVIF encoder as a
# loadable module, and is separate because it carries its own codec.
# The server degrades rather than fails when these are missing — the render
# endpoint serves the original with `x-baselyra-transform: unavailable` — so an
# image built without them still runs.
RUN apk add --no-cache tini postgresql17-client vips-tools vips-heif
WORKDIR /app
ENV NODE_ENV=production

COPY package.json package-lock.json* ./
RUN npm install --omit=dev --no-audit --no-fund && npm cache clean --force

COPY --from=server-build /build/dist ./dist
# worker.js is plain JavaScript, so tsc does not emit it into dist/. Without
# this line every edge-function invocation fails at runtime looking for it.
COPY src/functions/worker.js ./dist/functions/worker.js
COPY --from=studio-build /build/dist ./studio
COPY db ./db
COPY scripts ./scripts

# The storage root is a volume in compose; creating it here keeps a bare
# `docker run` from failing on first upload.
RUN mkdir -p /var/lib/baselyra/storage \
 && addgroup -g 10001 baselyra \
 && adduser -u 10001 -G baselyra -S -H baselyra \
 && chown -R baselyra:baselyra /var/lib/baselyra /app
USER baselyra

EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

ENTRYPOINT ["/sbin/tini", "--"]
CMD ["sh", "-c", "node scripts/migrate.js && node dist/index.js"]