neiam /gitgud

# Find eligible builder and runner images on Docker Hub. We use Ubuntu/Debian
# instead of Alpine to avoid DNS resolution issues in production.
#
# https://hub.docker.com/r/hexpm/elixir/tags?name=ubuntu
# https://hub.docker.com/_/ubuntu/tags
#
# This file is based on these images:
#
#   - https://hub.docker.com/r/hexpm/elixir/tags - for the build image
#   - https://hub.docker.com/_/debian/tags?name=trixie-20260505-slim - for the release image
#   - https://pkgs.org/ - resource for finding needed packages
#   - Ex: docker.io/hexpm/elixir:1.19.5-erlang-28.5.0.2-debian-trixie-20260623-slim
#
ARG ELIXIR_VERSION=1.19.5
# OTP 28.5.0.2 (was 28.4.1): refreshes the Erlang :ssh app (embedded git
# SSH daemon was hitting intermittent "incorrect signature" on 5.5.1).
ARG OTP_VERSION=28.5.0.2
ARG DEBIAN_VERSION=trixie-20260623-slim

ARG BUILDER_IMAGE="docker.io/hexpm/elixir:${ELIXIR_VERSION}-erlang-${OTP_VERSION}-debian-${DEBIAN_VERSION}"
ARG RUNNER_IMAGE="docker.io/debian:${DEBIAN_VERSION}"

FROM ${BUILDER_IMAGE} AS builder

# install build dependencies.
#   * build-essential, git — Elixir / mix build chain
#   * pkg-config, libssl-dev — gix transitively links against system openssl
#   * curl, ca-certificates — needed to bootstrap rustup
RUN apt-get update \
  && apt-get install -y --no-install-recommends \
       build-essential git pkg-config libssl-dev curl ca-certificates \
  && rm -rf /var/lib/apt/lists/*

# Rust via rustup, pinned. apt's rust on trixie is 1.85, but recent
# transitive gix deps (icu_*, home) require 1.86+; rustup keeps the
# compiler decoupled from the OS rev. Pinned to a known-good rev so
# builds are reproducible.
ENV RUSTUP_HOME=/usr/local/rustup \
    CARGO_HOME=/usr/local/cargo \
    PATH=/usr/local/cargo/bin:${PATH} \
    RUST_VERSION=1.88.0
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
  | sh -s -- -y --profile minimal --default-toolchain ${RUST_VERSION} \
  && rustc --version && cargo --version

# prepare build dir
WORKDIR /app

# install hex + rebar
RUN mix local.hex --force \
  && mix local.rebar --force

# set build ENV
ENV MIX_ENV="prod"

# install mix dependencies
COPY mix.exs mix.lock ./
RUN mix deps.get --only $MIX_ENV
RUN mkdir config

# copy compile-time config files before we compile dependencies
# to ensure any relevant config change will trigger the dependencies
# to be re-compiled.
COPY config/config.exs config/${MIX_ENV}.exs config/
RUN mix deps.compile

RUN mix assets.setup

COPY priv priv

COPY lib lib

# Rust source for the gitgud_gix NIF — Rustler invokes `cargo` from
# this directory during `mix compile`, so it must be present.
COPY native native

# Compile the release
RUN mix compile

COPY assets assets

# compile assets
RUN mix assets.deploy

# Changes to config/runtime.exs don't require recompiling the code
COPY config/runtime.exs config/

COPY rel rel

# Package source into the release so Sentry stacktraces show code
# context (lib/ is already copied above). Without this Sentry still
# reports errors, just without snippets, and warns at boot.
RUN mix sentry.package_source_code

RUN mix release

# start a new build stage so that the final image will only contain
# the compiled release and other runtime necessities
FROM ${RUNNER_IMAGE} AS final

# Runtime packages.
#   * libstdc++6, openssl, libncurses6, locales, ca-certificates — Erlang runtime
#   * git — the Cli backend shells out to git for ops the NIF hasn't covered
#     yet (commit_tree, update_ref, plumbing for profile-README seeding,
#     post-receive hook helpers). Also used by the embedded SSH daemon to
#     spawn upload-pack / receive-pack per session.
#   * openssh-client — ships `ssh-keygen`, which `GitGud.Ssh.Server`
#     shells out to on first boot to generate the host keys (ed25519,
#     rsa, ecdsa) if they're absent from `SSH_HOST_KEY_DIR`.
#   * curl — `priv/scripts/gitgud-hook` (pre-receive + post-receive
#     bridge) POSTs ref-update payloads to the Phoenix endpoint via
#     curl. Without it, branch protection checks and the
#     CommitBackfill / push-event publishing chain never fire on
#     SSH-side pushes. Mandatory.
#   * tini — proper PID 1 / zombie reaping, recommended for any container
#     image running long-lived child processes (we fork git per session).
RUN apt-get update \
  && apt-get install -y --no-install-recommends \
       libstdc++6 openssl libncurses6 locales ca-certificates \
       git openssh-client curl tini \
  && rm -rf /var/lib/apt/lists/*

# Set the locale
RUN sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen \
  && locale-gen

ENV LANG=en_US.UTF-8
ENV LANGUAGE=en_US:en
ENV LC_ALL=en_US.UTF-8

WORKDIR "/app"
RUN chown nobody /app

# set runner ENV
ENV MIX_ENV="prod"

# Only copy the final release from the build stage
COPY --from=builder --chown=nobody:root /app/_build/${MIX_ENV}/rel/git_gud ./

USER nobody

# tini as PID 1 — reaps the git child processes we fork from the embedded
# SSH daemon + plumbing helpers. Without this, zombies accumulate across
# pushes / pulls in long-lived containers. The package installs the
# binary at /usr/bin/tini on debian; symlinks for safety.
ENTRYPOINT ["/usr/bin/tini", "--"]

CMD ["/app/bin/server"]