Dockerfile

# ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
# Cortex - Multi-stage Docker Build
# ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
#
# Multi-stage build for the Cortex AI Provider Gateway:
#   1. Frontend stage:  Builds the React web interface
#   2. Rust builder:    Compiles the Rust binary
#   3. Runtime stage:   Creates a minimal production image
#
# Usage:
#   docker compose up --build
#
# ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

# ┌─────────────────────────────────────────────────────────────────────────────┐
# │ Stage 1: Frontend Build                                                     │
# └─────────────────────────────────────────────────────────────────────────────┘
#
# Builds the React frontend using Node.js.
# Output: static assets served by cortex via tower-http ServeDir.
#
FROM node:22-alpine AS frontend-builder

WORKDIR /build/web

# Copy package files first for dependency caching
COPY web/package.json web/package-lock.json ./
RUN npm ci

# Copy frontend source and build production bundle
COPY web/ ./
RUN npm run build


# ┌─────────────────────────────────────────────────────────────────────────────┐
# │ Stage 2: Download cortex-oauth CLI binaries                                 │
# └─────────────────────────────────────────────────────────────────────────────┘
#
# Downloads pre-built cortex-oauth CLI binaries from GitHub releases.
# These are served to users via /api/oauth/cli/:platform so they can
# authenticate with OAuth providers that require the authorization_code flow.
#
FROM alpine:3.19 AS oauth-cli-binaries

WORKDIR /binaries

# Copy pre-downloaded binaries from the GitHub Actions workflow
# The workflow downloads the latest oauth-* release and extracts the tarballs
COPY oauth-binaries/cortex-oauth-x86_64-unknown-linux-gnu ./cortex-oauth-x86_64-unknown-linux-gnu
COPY oauth-binaries/cortex-oauth-aarch64-unknown-linux-gnu ./cortex-oauth-aarch64-unknown-linux-gnu
COPY oauth-binaries/cortex-oauth-x86_64-apple-darwin ./cortex-oauth-x86_64-apple-darwin
COPY oauth-binaries/cortex-oauth-aarch64-apple-darwin ./cortex-oauth-aarch64-apple-darwin
COPY oauth-binaries/cortex-oauth-x86_64-pc-windows-msvc.exe ./cortex-oauth-x86_64-pc-windows-msvc.exe

# Verify all 5 expected binaries exist
RUN set -e; \
    for platform in \
        x86_64-unknown-linux-gnu \
        aarch64-unknown-linux-gnu \
        x86_64-apple-darwin \
        aarch64-apple-darwin; do \
        if [ ! -f "/binaries/cortex-oauth-${platform}" ]; then \
            echo "ERROR: Missing binary: cortex-oauth-${platform}"; \
            exit 1; \
        fi; \
        if [ ! -x "/binaries/cortex-oauth-${platform}" ]; then \
            echo "ERROR: Binary not executable: cortex-oauth-${platform}"; \
            exit 1; \
        fi; \
    done && \
    if [ ! -f "/binaries/cortex-oauth-x86_64-pc-windows-msvc.exe" ]; then \
        echo "ERROR: Missing binary: cortex-oauth-x86_64-pc-windows-msvc.exe"; \
        exit 1; \
    fi && \
    echo "✓ All 5 binaries verified" && \
    ls -lh /binaries/


# ┌─────────────────────────────────────────────────────────────────────────────┐
# │ Stage 3: Rust Build                                                         │
# └─────────────────────────────────────────────────────────────────────────────┘
#
# Compiles the Cortex Rust binary.
# Uses dependency caching via a dummy-source pre-build step.
#
FROM rust:1.85-slim-bookworm AS rust-builder

# Install build dependencies
RUN apt-get update && apt-get install -y \
    pkg-config \
    libssl-dev \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# ─────────────────────────────────────────────────────────────────────────────
# Dependency Caching Layer
# ─────────────────────────────────────────────────────────────────────────────
# Copy workspace Cargo.toml/Cargo.lock and member Cargo.toml, then build
# with dummy sources. This layer is cached until Cargo.toml/lock change.
#
COPY Cargo.toml Cargo.lock ./
COPY cortex-server/Cargo.toml ./cortex-server/

# Only build cortex-server in Docker (cortex-oauth is a local CLI tool)
RUN sed -i 's/members = \["cortex-server", "cortex-oauth"\]/members = ["cortex-server"]/' Cargo.toml

# Create dummy source to compile dependencies
RUN mkdir -p cortex-server/src && \
    echo 'fn main() { println!("dummy"); }' > cortex-server/src/main.rs && \
    echo '' > cortex-server/src/lib.rs

# Build deps only (cached until Cargo.toml/lock change)
RUN cargo build --release -p cortex-server 2>/dev/null || true

# Clean dummy artifacts so real source triggers recompilation
RUN rm -rf cortex-server/src \
    target/release/deps/cortex* \
    target/release/deps/libcortex* \
    target/release/cortex*

# ─────────────────────────────────────────────────────────────────────────────
# Build the actual binary
# ─────────────────────────────────────────────────────────────────────────────
COPY cortex-server/ ./cortex-server/

# Copy frontend dist for static file serving (tower-http ServeDir)
COPY --from=frontend-builder /build/web/dist /app/web/dist

RUN cargo build --release -p cortex-server


# ┌─────────────────────────────────────────────────────────────────────────────┐
# │ Stage 4: Runtime                                                             │
# └─────────────────────────────────────────────────────────────────────────────┘
#
# Minimal Debian image with just what's needed to run the binary.
# Uses bookworm-slim (glibc-based) since Rust links against glibc by default.
#
FROM debian:bookworm-slim AS runtime

# Install minimal runtime dependencies
RUN apt-get update && apt-get install -y \
    ca-certificates \
    curl \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Copy the compiled binary
COPY --from=rust-builder /app/target/release/cortex /app/cortex

# Copy frontend assets (served at runtime via tower-http ServeDir)
COPY --from=frontend-builder /build/web/dist /app/web/dist

# Copy cortex-oauth CLI binaries (served via /api/oauth/cli/:platform)
COPY --from=oauth-cli-binaries /binaries /opt/cortex-oauth

# Create data directory for SQLite database
RUN mkdir -p /app/data && chmod 755 /app/data

# ─────────────────────────────────────────────────────────────────────────────
# Environment defaults
# ─────────────────────────────────────────────────────────────────────────────
ENV CORTEX_PORT=8090
ENV CORTEX_ENCRYPTION_KEY=change-me-in-production
ENV RUST_LOG=cortex_server=info,tower_http=info

EXPOSE 8090
EXPOSE 8443

# ─────────────────────────────────────────────────────────────────────────────
# Health Check
# ─────────────────────────────────────────────────────────────────────────────
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD curl -f http://localhost:8090/api/health || exit 1

# ─────────────────────────────────────────────────────────────────────────────
# Security: Non-root user
# ─────────────────────────────────────────────────────────────────────────────
RUN groupadd -g 1000 cortex && \
    useradd -u 1000 -g cortex -s /bin/false cortex && \
    chown -R cortex:cortex /app

USER cortex

# ─────────────────────────────────────────────────────────────────────────────
# Entrypoint
# ─────────────────────────────────────────────────────────────────────────────
ENTRYPOINT ["/app/cortex"]
CMD []