Dockerfile

# syntax=docker/dockerfile:1.7

# ─── Builder stage ───────────────────────────────────────────────────────────
# Installs dependencies in a fat image so that better-sqlite3 has access to a
# C toolchain if the prebuilt binary isn't available for the host architecture.
FROM node:20-bookworm-slim AS builder

# Build dependencies for native modules (better-sqlite3 falls back to source
# build when there is no prebuilt binary for the platform).
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        python3 \
        make \
        g++ \
        ca-certificates \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Layer caching: copy manifests first, install, then copy the rest.
COPY package.json package-lock.json* ./
RUN npm ci --omit=dev --no-audit --no-fund

# Copy the application source.
COPY . .

# ─── Runtime stage ───────────────────────────────────────────────────────────
# Minimal image: just Node, the app source, and the pruned production
# node_modules from the builder. Runs as a non-root user.
FROM node:20-bookworm-slim AS runtime

# Avoid running tools that don't ship sensible defaults inside this image.
ENV NODE_ENV=production \
    NPM_CONFIG_LOGLEVEL=warn \
    DB_PATH=/app/data/stake.db

# Curl is occasionally useful for healthchecks; tini gives us proper signal
# handling so SIGTERM from `docker stop` is delivered cleanly to Node.
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        tini \
        ca-certificates \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd --system --gid 1001 easystake \
    && useradd  --system --uid 1001 --gid easystake --shell /usr/sbin/nologin --home-dir /app easystake

WORKDIR /app

# Bring over the application and its already-installed (production-only)
# dependencies from the builder stage.
COPY --from=builder --chown=easystake:easystake /app /app

# stake.db is created on first run inside /app/data (DB_PATH points there).
# Mount a volume here in production so the database survives container
# replacements.
RUN mkdir -p /app/data \
    && chown -R easystake:easystake /app/data

USER easystake

# tini reaps zombies and forwards signals to node so graceful SIGINT/SIGTERM
# shutdown (the path stakebot.js handles) works inside Docker.
ENTRYPOINT ["/usr/bin/tini", "--"]
CMD ["node", "stakebot.js"]

# Mark the data dir as a volume so `docker run` keeps the DB across restarts
# even without an explicit -v flag.
VOLUME ["/app/data"]