Dockerfile

FROM node:24-bookworm-slim AS base

# build stage
FROM base AS deps

RUN corepack enable && corepack prepare pnpm@9 --activate

WORKDIR /app

COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./

RUN pnpm install --frozen-lockfile --prod

FROM base AS builder

RUN corepack enable && corepack prepare pnpm@9 --activate

WORKDIR /app

COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./

RUN pnpm install --frozen-lockfile

COPY . .

RUN sed -i "s/images:/output: 'standalone',images:/" next.config.ts

RUN pnpm run build

# run stage
FROM base AS runner

ENV NODE_ENV=production
ENV HOSTNAME=

RUN echo 'deb http://deb.debian.org/debian bookworm-backports main' >> /etc/apt/sources.list
RUN apt-get update && apt-get install -y \
    supervisor curl jq jc borgbackup/bookworm-backports openssh-server gosu && \
    apt-get clean && rm -rf /var/lib/apt/lists/*

# Remove the SSH host keys generated by the openssh-server install so the image
# never ships shared host keys. Fresh keys are generated at first boot by the
# entrypoint.
RUN rm -f /etc/ssh/ssh_host_*

# Remove the default 'node' user (UID 1000) to avoid conflicts with PUID=1000
RUN userdel -r node 2>/dev/null || true

RUN groupadd -g 1001 borgwarehouse && useradd -m -u 1001 -g 1001 -p '*' borgwarehouse

RUN cp /etc/ssh/moduli /home/borgwarehouse/

WORKDIR /home/borgwarehouse/app

# App files stay root:root (world-readable). Node runs as borgwarehouse and
# only needs read/execute access. Keeping the code root-owned makes it
# immutable from the running process: a compromised app cannot rewrite its
# own binaries to persist. Writable paths (volumes + $HOME) are chowned at
# runtime by the entrypoint.
COPY --from=builder /app/docker/docker-bw-init.sh /app/LICENSE ./
COPY --from=builder /app/helpers/shells ./helpers/shells
COPY --from=builder /app/.next/standalone ./
COPY --from=builder /app/public ./public
COPY --from=builder /app/.next/static ./.next/static
COPY --from=builder /app/docker/supervisord.conf ./
COPY --from=builder /app/docker/sshd_config ./

# Container starts as root to handle PUID/PGID remapping at runtime.
# The entrypoint drops to borgwarehouse before starting the app.

EXPOSE 3000 22

ENTRYPOINT ["./docker-bw-init.sh"]