Dockerfile.server

# Build the multi-tenant transport server (cmd/server) from the unified
# engine module. Unlike the old standalone server repo, there are no
# sibling modules — the engine library lives here and llmgate is a normal
# tagged dependency fetched by `go mod download`.
#
# Usage:  docker build -f Dockerfile.server -t vectorless-server .

# Compile on the build machine for the target platform: no emulated
# go build for arm64, and the binary matches the image it ships in.
FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS build

RUN apk add --no-cache ca-certificates

WORKDIR /src

# Cache module downloads (includes llmgate from public GitHub).
COPY go.mod go.sum ./
RUN go mod download

# Copy only the source needed to compile the server binary.
COPY cmd/      ./cmd/
COPY pkg/      ./pkg/
COPY internal/ ./internal/
COPY gen/      ./gen/

ARG VERSION=dev
ARG TARGETOS
ARG TARGETARCH
RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH:-amd64} \
    go build \
      -trimpath \
      -ldflags="-s -w -X main.version=${VERSION}" \
      -o /bin/vectorless-server \
      ./cmd/server

# ── Runtime stage ──────────────────────────────────────────────────
# Alpine rather than distroless/static for one program: poppler's
# pdftoppm, which renders PDF pages to the images pincite cards and the
# document viewer show (HAL-834). It runs out of process, so the server
# binary itself stays pure Go (CGO_ENABLED=0 above). Without it the
# server still starts; citations keep their regions and page images
# report 501.
FROM alpine:3.20

RUN apk add --no-cache ca-certificates poppler-utils \
 && addgroup -S -g 65532 nonroot \
 && adduser -S -u 65532 -G nonroot -h /home/nonroot -s /sbin/nologin nonroot

# pdfcpu (under pdftable) writes its configuration to $HOME/.config on first
# use and panics if it cannot: with no home directory, every PDF ingest
# failed with "mkdir /home/nonroot: permission denied".
ENV HOME=/home/nonroot

# /data is where a self-hosted engine keeps documents with the local
# storage driver. Created here, owned by nonroot, so a named volume
# mounted on it starts writable (Docker copies the ownership).
RUN mkdir -p /data/documents && chown -R nonroot:nonroot /data

COPY --from=build /bin/vectorless-server /vectorless-server

USER nonroot:nonroot
ENTRYPOINT ["/vectorless-server"]
CMD ["--role", "server"]

EXPOSE 8080

LABEL org.opencontainers.image.title="vectorless-server"
LABEL org.opencontainers.image.description="Vectorless transport server — HTTP + gRPC over the engine library"
LABEL org.opencontainers.image.source="https://github.com/hallelx2/vectorless-engine"
LABEL org.opencontainers.image.licenses="Apache-2.0"
LABEL org.opencontainers.image.vendor="Vectorless"