rstillwell/Submatter
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
Submatter/docker/Dockerfile
Randall Stillwell b513b3b04f fix(docker): serialize Coolify builds and harden web/worker image inputs 
Avoid Coolify OOM crashes by documenting and scripting sequential service builds, and make Docker builds resilient to local-only .env symlinks and missing .cursor agent paths.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-08 01:00:21 -05:00

298 lines
12 KiB
Docker
Raw Blame History

# syntax=docker/dockerfile:1
#
# Single multi-stage Dockerfile for ECHODO. Build via Docker Compose with
# `target:` to select web | collab | mcp | orchestrator | worker.
#
# Why one file instead of three?
# - The `deps` stage runs `pnpm install` ONCE for all 723 workspace packages.
# BuildKit shares it across every downstream target by content hash, so
# web + collab + mcp build in parallel without three concurrent installs
# blowing through the build host's RAM.
# - Per-app build stages (`web-build`, `collab-build`, `mcp-build`) only
# copy the source they actually need.
# - Final runtime stages (`web`, `collab`, `mcp`) pull just the built
# artifacts and the per-app node_modules they need at runtime.
ARG NODE_VERSION=20.18.1
# ============================================================================
# base — shared toolchain
# ============================================================================
FROM node:${NODE_VERSION}-alpine AS base
RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
WORKDIR /app
# ============================================================================
# deps — shared pnpm install for the entire workspace
# Cached aggressively: invalidates only when package.json or lockfile changes.
# ============================================================================
FROM base AS deps
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml turbo.json tsconfig.json ./
COPY apps/web/package.json ./apps/web/
COPY apps/collab-server/package.json ./apps/collab-server/
COPY apps/mcp-server/package.json ./apps/mcp-server/
COPY apps/orchestrator/package.json ./apps/orchestrator/
COPY apps/worker/package.json ./apps/worker/
COPY packages/database/package.json ./packages/database/
COPY packages/shared/package.json ./packages/shared/
COPY packages/ai/package.json ./packages/ai/
RUN pnpm install --frozen-lockfile
# NOTE: Stage order matters. `web-build` must be defined AFTER `collab-build`
# and `mcp-build` because it `COPY --from=`s them to force BuildKit to
# finish the light tsup builds before starting the heavy Next.js compile.
# Coolify's builder requires stages referenced via `--from=` to be defined
# above the referencing stage; forward references fail with "cannot copy
# from stage X, it needs to be defined before current stage Y".
# ============================================================================
# collab-build — tsup build for Hocuspocus server
# ============================================================================
FROM deps AS collab-build
COPY apps/collab-server ./apps/collab-server
COPY packages/database ./packages/database
ENV NODE_ENV=production
RUN pnpm exec turbo build --filter=@tasks/collab-server
# ============================================================================
# mcp-build — tsup build for MCP server
# ============================================================================
FROM deps AS mcp-build
COPY apps/mcp-server ./apps/mcp-server
COPY packages/database ./packages/database
COPY packages/shared ./packages/shared
ENV NODE_ENV=production
RUN pnpm exec turbo build --filter=@tasks/mcp-server
# ============================================================================
# orchestrator-build — tsup build for convoy driver
# ============================================================================
FROM deps AS orchestrator-build
COPY apps/orchestrator ./apps/orchestrator
COPY packages/database ./packages/database
COPY packages/shared ./packages/shared
ENV NODE_ENV=production
RUN pnpm exec turbo build --filter=@tasks/orchestrator
# ============================================================================
# worker-build — tsup build for agent runtime
# ============================================================================
FROM deps AS worker-build
COPY apps/worker ./apps/worker
COPY packages/ai ./packages/ai
COPY packages/database ./packages/database
COPY packages/shared ./packages/shared
ENV NODE_ENV=production
RUN pnpm exec turbo build --filter=@tasks/worker
# ============================================================================
# web-build — Next.js production build → standalone output
# ============================================================================
FROM deps AS web-build
COPY apps/web ./apps/web
COPY packages/ai ./packages/ai
COPY packages/database ./packages/database
COPY packages/shared ./packages/shared
COPY docker/next.config.docker.ts ./apps/web/next.config.ts
# Force BuildKit to finish the two tsup builds before starting the heavy
# Next.js compile. docker-compose's `depends_on` only orders runtime startup,
# not `docker compose build` — without these COPYs, BuildKit runs all three
# build stages in parallel and the host OOMs around the 73s mark of the web
# build (kernel reaps with exit 255 and no Docker error, matching the warning
# below about heap sizing). The copied files are throwaway markers; the
# runtime web image never reads /tmp.
COPY --from=collab-build /app/apps/collab-server/dist/index.mjs /tmp/.collab-built
COPY --from=mcp-build /app/apps/mcp-server/dist/index.js /tmp/.mcp-built
COPY --from=orchestrator-build /app/apps/orchestrator/dist/index.js /tmp/.orchestrator-built
COPY --from=worker-build /app/apps/worker/dist/index.js /tmp/.worker-built
ENV NEXT_TELEMETRY_DISABLED=1
ENV NODE_ENV=production
# Give the Next.js webpack compile enough V8 heap headroom on the Coolify host.
# Sized to ~60% of an 8 GB host so kernel + dockerd + buildkit + concurrent
# tsup workers still have breathing room. Below ~3 GB the compile spirals
# into GC churn and gets oom-killed (exit 255 with no Docker error).
ENV NODE_OPTIONS=--max-old-space-size=5120
# Local dev uses a gitignored apps/web/.env symlink; drop it so Next.js does not
# follow a broken link inside the container.
RUN rm -f apps/web/.env apps/web/.env.local apps/web/.env.production apps/web/.env.development
RUN pnpm exec turbo build --filter=@tasks/web
# ============================================================================
# web — runtime image (Next.js standalone)
# ============================================================================
FROM node:${NODE_VERSION}-alpine AS web
RUN apk add --no-cache wget \
&& addgroup --system --gid 1001 nodejs \
&& adduser --system --uid 1001 nextjs
WORKDIR /app
ENV NODE_ENV=production
ENV PORT=3000
ENV HOSTNAME=0.0.0.0
COPY --from=web-build --chown=nextjs:nodejs /app/apps/web/.next/standalone ./
COPY --from=web-build --chown=nextjs:nodejs /app/apps/web/.next/static ./apps/web/.next/static
COPY --from=web-build --chown=nextjs:nodejs /app/apps/web/public ./apps/web/public
USER nextjs
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
CMD wget -qO- --timeout=3 http://127.0.0.1:3000/ >/dev/null || exit 1
CMD ["node", "apps/web/server.js"]
# ============================================================================
# collab — runtime image (Hocuspocus / Yjs websocket)
# ============================================================================
FROM node:${NODE_VERSION}-alpine AS collab
RUN addgroup --system --gid 1001 nodejs \
&& adduser --system --uid 1001 collab --ingroup nodejs
WORKDIR /app
ENV NODE_ENV=production
ENV PORT=1234
COPY --from=collab-build --chown=collab:nodejs /app/node_modules ./node_modules
COPY --from=collab-build --chown=collab:nodejs /app/packages/database ./packages/database
COPY --from=collab-build --chown=collab:nodejs /app/apps/collab-server/dist ./apps/collab-server/dist
COPY --from=collab-build --chown=collab:nodejs /app/apps/collab-server/package.json ./apps/collab-server/package.json
COPY --from=collab-build --chown=collab:nodejs /app/apps/collab-server/node_modules ./apps/collab-server/node_modules
USER collab
EXPOSE 1234
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
CMD node -e "const p=+(process.env.PORT||1234);require('net').createConnection(p,'127.0.0.1').on('connect',()=>process.exit(0)).on('error',()=>process.exit(1))"
WORKDIR /app/apps/collab-server
CMD ["node", "dist/index.mjs"]
# ============================================================================
# mcp — runtime image (Model Context Protocol server)
# ============================================================================
FROM node:${NODE_VERSION}-alpine AS mcp
ARG MCP_SERVER_PORT=3001
ENV MCP_SERVER_PORT=${MCP_SERVER_PORT}
RUN apk add --no-cache procps \
&& addgroup --system --gid 1001 nodejs \
&& adduser --system --uid 1001 mcp --ingroup nodejs
WORKDIR /app
ENV NODE_ENV=production
COPY --from=mcp-build --chown=mcp:nodejs /app/node_modules ./node_modules
COPY --from=mcp-build --chown=mcp:nodejs /app/packages/database ./packages/database
COPY --from=mcp-build --chown=mcp:nodejs /app/packages/shared ./packages/shared
COPY --from=mcp-build --chown=mcp:nodejs /app/apps/mcp-server/dist ./apps/mcp-server/dist
COPY --from=mcp-build --chown=mcp:nodejs /app/apps/mcp-server/package.json ./apps/mcp-server/package.json
COPY --from=mcp-build --chown=mcp:nodejs /app/apps/mcp-server/node_modules ./apps/mcp-server/node_modules
USER mcp
WORKDIR /app/apps/mcp-server
EXPOSE 3001
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
CMD pgrep -f "node.*dist/index\\.js" > /dev/null || exit 1
CMD ["node", "dist/index.js"]
# ============================================================================
# orchestrator — runtime image (convoy driver + Redis enqueue)
# ============================================================================
FROM node:${NODE_VERSION}-alpine AS orchestrator
RUN addgroup --system --gid 1001 nodejs \
&& adduser --system --uid 1001 orchestrator --ingroup nodejs
WORKDIR /app
ENV NODE_ENV=production
COPY --from=orchestrator-build --chown=orchestrator:nodejs /app/node_modules ./node_modules
COPY --from=orchestrator-build --chown=orchestrator:nodejs /app/packages/database ./packages/database
COPY --from=orchestrator-build --chown=orchestrator:nodejs /app/packages/shared ./packages/shared
COPY --from=orchestrator-build --chown=orchestrator:nodejs /app/apps/orchestrator/dist ./apps/orchestrator/dist
COPY --from=orchestrator-build --chown=orchestrator:nodejs /app/apps/orchestrator/package.json ./apps/orchestrator/package.json
COPY --from=orchestrator-build --chown=orchestrator:nodejs /app/apps/orchestrator/node_modules ./apps/orchestrator/node_modules
USER orchestrator
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
CMD pgrep -f "node.*dist/index\\.js" > /dev/null || exit 1
WORKDIR /app/apps/orchestrator
CMD ["node", "dist/index.js"]
# ============================================================================
# worker — runtime image (orchestrator job consumer + tool loop)
# ============================================================================
FROM node:${NODE_VERSION}-alpine AS worker
RUN apk add --no-cache git ripgrep procps \
&& addgroup --system --gid 1001 nodejs \
&& adduser --system --uid 1001 worker --ingroup nodejs
WORKDIR /app
ENV NODE_ENV=production
ENV WORKER_REPO_ROOT=/app/repo
COPY --from=worker-build --chown=worker:nodejs /app/node_modules ./node_modules
COPY --from=worker-build --chown=worker:nodejs /app/packages/ai ./packages/ai
COPY --from=worker-build --chown=worker:nodejs /app/packages/database ./packages/database
COPY --from=worker-build --chown=worker:nodejs /app/packages/shared ./packages/shared
COPY --from=worker-build --chown=worker:nodejs /app/apps/worker/dist ./apps/worker/dist
COPY --from=worker-build --chown=worker:nodejs /app/apps/worker/package.json ./apps/worker/package.json
COPY --from=worker-build --chown=worker:nodejs /app/apps/worker/node_modules ./apps/worker/node_modules
# Repo snapshot for tool loop + git worktrees (dogfood / connected-repo jobs).
COPY --chown=worker:nodejs apps ./repo/apps
COPY --chown=worker:nodejs packages ./repo/packages
COPY --chown=worker:nodejs plans ./repo/plans
COPY --chown=worker:nodejs .cursor/mcp.json ./repo/.cursor/mcp.json
COPY --chown=worker:nodejs .cursor/rules ./repo/.cursor/rules
RUN mkdir -p /app/repo/.cursor/agents
COPY --chown=worker:nodejs pnpm-workspace.yaml package.json turbo.json tsconfig.json ./repo/
# Minimal git repo so worktrees + allowlisted git commands work on the deploy snapshot.
USER root
RUN cd /app/repo \
&& git init -q \
&& git config user.email "worker@echodo" \
&& git config user.name "echodo-worker" \
&& git add -A \
&& git -c commit.gpgsign=false commit -q -m "deploy snapshot" \
|| true
USER worker
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
CMD pgrep -f "node.*dist/index\\.js" > /dev/null || exit 1
WORKDIR /app/apps/worker
CMD ["node", "dist/index.js"]
Reference in a new issue View git blame Copy permalink