# Build stage
FROM rust:1.96.1-slim-bookworm@sha256:e18a79fc84dfcfc3ab5ba72290398a644c135c97eaa881447fddc354ee4701a3 AS builder
WORKDIR /app
RUN apt-get update && \
apt-get install -y --no-install-recommends \
pkg-config \
libssl-dev && \
rm -rf /var/lib/apt/lists/*
# Copy manifests first for dependency caching
COPY Cargo.toml Cargo.lock ./
# Create a dummy src to build dependencies
RUN mkdir -p src/bin && \
echo "pub const VERSION: &str = \"0.0.0\";" > src/lib.rs && \
echo "fn main() {}" > src/main.rs && \
echo "fn main() {}" > src/bin/with-router.rs && \
cargo build --release --locked && \
rm -rf src
# Copy the committed admin UI before the Rust source. RustEmbed needs this
# directory at compile time, and keeping it in a separate layer preserves the
# cache when only Rust source changes.
COPY ui/dist/ ui/dist/
# Copy real source code
COPY src/ src/
# Touch files to invalidate cache for source changes
RUN touch src/lib.rs src/main.rs && \
cargo build --release --locked
# Runtime base
#
FROM oven/bun:1@sha256:e10577f0db68676a7024391c6e5cb4b879ebd17188ab750cf10024a6d700e5c4 AS bun-runtime
# Deliberately contains no vendor CLI. Native OAuth creates and refreshes the
# credential; bun is only a small runner for a disposable compatibility flow.
FROM debian:bookworm-slim@sha256:abd67ffcfa541b485a3dff59865ab629aa048a6c613e639d36e7456b0b229241 AS runtime-base
RUN apt-get update && \
apt-get install -y --no-install-recommends ca-certificates && \
rm -rf /var/lib/apt/lists/*
COPY --from=bun-runtime /usr/local/bin/bun /usr/local/bin/bun
COPY --from=builder /app/target/release/link-assistant-router /usr/local/bin/link-assistant-router
COPY --from=builder /app/target/release/with-router /usr/local/bin/with-router
# Default environment
ENV ROUTER_PORT=8080
ENV CLAUDE_CODE_HOME=/data/claude
# The login flow writes the credential it obtains here, so this must be
# writable — a read-only mount makes `POST /api/login` fail immediately.
RUN mkdir -p /data/claude
EXPOSE 8080
ENTRYPOINT ["link-assistant-router"]
# Single published runtime stage.
FROM runtime-base AS runtime