Dockerfile

# ─────────────────────────────────────────────────────────────────────────────
# The agent worker: Fastify factory loop + the Python strategy runtime.
#
# One image, two processes. The agent is a long-running, single-instance
# process — it owns the SQLite/Postgres state and six setInterval cadences, so
# it must NOT be deployed serverless or scaled horizontally. The Python runtime
# is pure stdlib (no wheels, no compiler) and is only ever reached over
# loopback, which is why they share a container rather than a network.
# ─────────────────────────────────────────────────────────────────────────────

FROM node:22-bookworm-slim AS build
WORKDIR /app

RUN corepack enable
# Non-interactive install: pnpm otherwise refuses to replace node_modules
# without a TTY when pruning dev dependencies below.
ENV CI=true

COPY pnpm-lock.yaml pnpm-workspace.yaml package.json ./
COPY apps/agent/package.json apps/agent/
RUN pnpm install --frozen-lockfile --filter @nectar/agent...

COPY apps/agent apps/agent
RUN pnpm --filter @nectar/agent build

# Drop dev dependencies from the layer that ships.
RUN pnpm install --frozen-lockfile --prod --filter @nectar/agent...

# ── runtime image ────────────────────────────────────────────────────────────
FROM node:22-bookworm-slim
WORKDIR /app

RUN apt-get update \
 && apt-get install -y --no-install-recommends python3 tini \
 && rm -rf /var/lib/apt/lists/*

ENV NODE_ENV=production \
    PYTHONPATH=/app/packages/strategy-runtime \
    PYTHONDONTWRITEBYTECODE=1 \
    RUNTIME_HOST=127.0.0.1 \
    METER_HOST=127.0.0.1 \
    AGENT_PORT=8787 \
    RUNTIME_PORT=8799 \
    DB_PATH=/data/nectar.db

COPY --from=build /app/node_modules node_modules
COPY --from=build /app/apps/agent/node_modules apps/agent/node_modules
COPY --from=build /app/apps/agent/dist apps/agent/dist
COPY --from=build /app/apps/agent/package.json apps/agent/package.json
COPY packages/strategy-runtime packages/strategy-runtime
COPY docker-entrypoint.sh /usr/local/bin/entrypoint

# The worker holds a funded key; it has no reason to be root, and the Python
# child runner it supervises is executing untrusted strategy code.
RUN chmod +x /usr/local/bin/entrypoint \
 && mkdir -p /data \
 && chown -R node:node /data /app
USER node

VOLUME ["/data"]
EXPOSE 8787

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD node -e "fetch('http://127.0.0.1:'+(process.env.AGENT_PORT||8787)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

# tini reaps the sandbox subprocesses the runtime spawns per backtest.
ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/entrypoint"]