# Build stage
FROM rust:1-slim-bookworm AS builder
WORKDIR /app
RUN apt-get update && \
apt-get install -y --no-install-recommends \
pkg-config \
libssl-dev && \
rm -rf /var/lib/apt/lists/*
# Copy manifests first for dependency caching
COPY Cargo.toml Cargo.lock ./
# Create a dummy src to build dependencies
RUN mkdir src && \
echo "pub const VERSION: &str = \"0.0.0\";" > src/lib.rs && \
echo "fn main() {}" > src/main.rs && \
cargo build --release --locked && \
rm -rf src
# Copy the committed admin UI before the Rust source. RustEmbed needs this
# directory at compile time, and keeping it in a separate layer preserves the
# cache when only Rust source changes.
COPY ui/dist/ ui/dist/
# Copy real source code
COPY src/ src/
# Touch files to invalidate cache for source changes
RUN touch src/lib.rs src/main.rs && \
cargo build --release --locked
# Runtime base
#
FROM oven/bun:1 AS bun-runtime
# Deliberately contains no vendor CLI. Native OAuth creates and refreshes the
# credential; bun is only a small runner for a disposable compatibility flow.
FROM debian:bookworm-slim AS runtime-base
RUN apt-get update && \
apt-get install -y --no-install-recommends ca-certificates && \
rm -rf /var/lib/apt/lists/*
COPY --from=bun-runtime /usr/local/bin/bun /usr/local/bin/bun
COPY --from=builder /app/target/release/link-assistant-router /usr/local/bin/link-assistant-router
# Default environment
ENV ROUTER_PORT=8080
ENV CLAUDE_CODE_HOME=/data/claude
# The login flow writes the credential it obtains here, so this must be
# writable — a read-only mount makes `POST /api/login` fail immediately.
RUN mkdir -p /data/claude
EXPOSE 8080
ENTRYPOINT ["link-assistant-router"]
# Single published runtime stage.
FROM runtime-base AS runtime