pipeline/Dockerfile

# Stage 1: Install dependencies (isolated layout, same as local dev)
FROM node:22-bookworm AS deps

# Mirror switch: default ON (国内镜像源) for fast local/China builds.
# CI/CD on the release branch builds with --build-arg USE_CN_MIRROR=0 to use
# official sources (deb.debian.org / registry.npmjs.org / pypi.org /
# storage.googleapis.com). Resolved per-stage below.
ARG USE_CN_MIRROR=1

RUN set -eux; \
    if [ "$USE_CN_MIRROR" = "1" ]; then REG=https://registry.npmmirror.com; \
    else REG=https://registry.npmjs.org; fi; \
    corepack enable && \
    COREPACK_NPM_REGISTRY=$REG corepack prepare pnpm@10.24.0 --activate

# 系统包 + Python 依赖：国内源时改 apt 源并走阿里云 pypi；官方源时全用默认
RUN set -eux; \
    if [ "$USE_CN_MIRROR" = "1" ]; then \
      sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources; \
      PIP_INDEX=https://mirrors.aliyun.com/pypi/simple/; \
    else \
      PIP_INDEX=https://pypi.org/simple; \
    fi; \
    apt-get update && \
    apt-get install -y --no-install-recommends ffmpeg python3 python3-pip && \
    rm -rf /var/lib/apt/lists/* && \
    pip3 install --break-system-packages -i "$PIP_INDEX" faster-whisper

WORKDIR /app

COPY package.json pnpm-lock.yaml pnpm-workspace.yaml turbo.json ./
COPY apps/cli/package.json apps/cli/
COPY apps/web/package.json apps/web/
COPY packages/shared/package.json packages/shared/
COPY packages/core/package.json packages/core/
COPY packages/tts/package.json packages/tts/
COPY packages/templates/package.json packages/templates/
COPY packages/collect/package.json packages/collect/
COPY packages/text/package.json packages/text/
COPY packages/audio/package.json packages/audio/
COPY packages/renderer/package.json packages/renderer/

RUN set -eux; \
    if [ "$USE_CN_MIRROR" = "1" ]; then REG=https://registry.npmmirror.com; \
    else REG=https://registry.npmjs.org; fi; \
    pnpm config set registry "$REG" && \
    pnpm install --frozen-lockfile

# Stage 2: Build
FROM deps AS build

COPY . .
# `next start` only reads .next/{server,static,types,*.json}; the 189MB
# .next/cache is a webpack/swc build cache used solely by `next build`/dev.
# Drop it here so it never enters the runtime COPY (and never gets re-duplicated
# by the writable-dirs step below).
RUN pnpm build && rm -rf apps/web/.next/cache

# Stage 3: Runtime — fresh prod install with hoisted layout
FROM node:22-bookworm-slim AS runtime

# Mirror switch (see deps stage): default ON for local/China; CI passes
# --build-arg USE_CN_MIRROR=0 for official sources.
ARG USE_CN_MIRROR=1

RUN set -eux; \
    if [ "$USE_CN_MIRROR" = "1" ]; then REG=https://registry.npmmirror.com; \
    else REG=https://registry.npmjs.org; fi; \
    corepack enable && \
    COREPACK_NPM_REGISTRY=$REG corepack prepare pnpm@10.24.0 --activate

# 系统包（ffmpeg + Chrome 运行库 + 字体）+ Python 依赖：国内源时改 apt 源并走阿里云 pypi；官方源时全用默认
RUN set -eux; \
    if [ "$USE_CN_MIRROR" = "1" ]; then \
      sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources; \
      PIP_INDEX=https://mirrors.aliyun.com/pypi/simple/; \
    else \
      PIP_INDEX=https://pypi.org/simple; \
    fi; \
    apt-get update && \
    apt-get install -y --no-install-recommends \
      ffmpeg python3 python3-pip fontconfig \
      libnss3 libnspr4 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 \
      libxkbcommon0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 \
      libgbm1 libpango-1.0-0 libcairo2 libasound2 && \
    rm -rf /var/lib/apt/lists/* && \
    pip3 install --break-system-packages -i "$PIP_INDEX" faster-whisper

WORKDIR /app

# Copy workspace manifests + lockfile so pnpm install can resolve workspaces
COPY --from=build /app/package.json /app/pnpm-lock.yaml /app/pnpm-workspace.yaml /app/turbo.json ./
COPY --from=build /app/apps/cli/package.json apps/cli/
COPY --from=build /app/apps/web/package.json apps/web/
COPY --from=build /app/packages/shared/package.json packages/shared/
COPY --from=build /app/packages/core/package.json packages/core/
COPY --from=build /app/packages/tts/package.json packages/tts/
COPY --from=build /app/packages/templates/package.json packages/templates/
COPY --from=build /app/packages/collect/package.json packages/collect/
COPY --from=build /app/packages/text/package.json packages/text/
COPY --from=build /app/packages/audio/package.json packages/audio/
COPY --from=build /app/packages/renderer/package.json packages/renderer/

# Install production deps with hoisted layout (everything flat at root node_modules),
# then re-create the workspace symlinks at root so any package can resolve @pipeline/* by walking up.
RUN set -eux; \
    if [ "$USE_CN_MIRROR" = "1" ]; then REG=https://registry.npmmirror.com; \
    else REG=https://registry.npmjs.org; fi; \
    pnpm config set registry "$REG" && \
    pnpm install --frozen-lockfile --prod --config.node-linker=hoisted && \
    mkdir -p node_modules/@pipeline && \
    ln -s ../../packages/shared node_modules/@pipeline/shared && \
    ln -s ../../packages/core node_modules/@pipeline/core && \
    ln -s ../../packages/tts node_modules/@pipeline/tts && \
    ln -s ../../packages/templates node_modules/@pipeline/templates && \
    ln -s ../../packages/collect node_modules/@pipeline/collect && \
    ln -s ../../packages/text node_modules/@pipeline/text && \
    ln -s ../../packages/audio node_modules/@pipeline/audio && \
    ln -s ../../packages/renderer node_modules/@pipeline/renderer

# Copy build artifacts (dist, .next, template src for Remotion entry, etc.)
COPY --from=build /app/apps/cli/dist apps/cli/dist/
COPY --from=build --chown=node:node /app/apps/web/.next apps/web/.next/
COPY --from=build /app/apps/web/next.config.mjs apps/web/
COPY --from=build /app/apps/web/src apps/web/src/
COPY --from=build /app/packages/shared/dist packages/shared/dist/
COPY --from=build /app/packages/core/dist packages/core/dist/
COPY --from=build /app/packages/tts/dist packages/tts/dist/
COPY --from=build /app/packages/tts/scripts packages/tts/scripts/
COPY --from=build /app/packages/templates/dist packages/templates/dist/
COPY --from=build /app/packages/templates/src packages/templates/src/
COPY --from=build /app/packages/collect/dist packages/collect/dist/
COPY --from=build /app/packages/text/dist packages/text/dist/
COPY --from=build /app/packages/audio/dist packages/audio/dist/
COPY --from=build /app/packages/renderer/dist packages/renderer/dist/
COPY --from=build /app/assets assets/
COPY --from=build /app/config config/

# Install bundled Noto Sans SC as system font so Chrome can render CJK via fontconfig fallback
RUN mkdir -p /usr/share/fonts/truetype/noto && \
    cp assets/fonts/NotoSansSC-Regular.ttf assets/fonts/NotoSansSC-Bold.ttf /usr/share/fonts/truetype/noto/ && \
    fc-cache -f

# Bundle Remotion's headless Chrome so rendering needs NO network at runtime.
# Remotion normally auto-downloads chrome-headless-shell from Google's CDN
# (storage.googleapis.com / remotion.media) on first render, but that is
# ~5KB/s from CN networks and stalls indefinitely. Fetch the SAME binary
# Remotion wants from the Aliyun-backed npmmirror binary mirror at build time
# (host flips to storage.googleapis.com/chrome-for-testing-public when
# USE_CN_MIRROR=0, for the overseas CI/release build)
# and lay it out exactly as Remotion's BrowserFetcher expects, so
# ensureBrowser() finds it present (revision.local && existsSync(executablePath))
# and skips the download. Version is read from the installed @remotion/renderer
# so this auto-tracks Remotion upgrades instead of hardcoding a number.
RUN set -eux; \
    if [ "$USE_CN_MIRROR" = "1" ]; then CHROME_BASE=https://registry.npmmirror.com/-/binary/chrome-for-testing; \
    else CHROME_BASE=https://storage.googleapis.com/chrome-for-testing-public; fi; \
    SRC=/app/node_modules/@remotion/renderer/dist/browser/get-chrome-download-url.js; \
    VERSION=$(grep -oE "TESTED_VERSION = '[0-9.]+'" "$SRC" | grep -oE "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" | head -1); \
    test -n "$VERSION"; \
    CACHE=/app/node_modules/.remotion/chrome-headless-shell; \
    mkdir -p "$CACHE/linux64"; \
    URL="$CHROME_BASE/${VERSION}/linux64/chrome-headless-shell-linux64.zip"; \
    node -e "const fs=require('fs');fetch(process.argv[1]).then(r=>r.arrayBuffer()).then(b=>fs.writeFileSync(process.argv[2],Buffer.from(b)))" "$URL" /tmp/chs.zip; \
    python3 -m zipfile -e /tmp/chs.zip "$CACHE/linux64/"; \
    rm -f /tmp/chs.zip; \
    BIN="$CACHE/linux64/chrome-headless-shell-linux64/chrome-headless-shell"; \
    chmod +x "$BIN"; \
    printf '%s' "$VERSION" > "$CACHE/VERSION"

# Run as the non-root `node` user (uid/gid 1000, shipped in the base image) so
# the image is Pod Security "restricted"-friendly. We only chown the SMALL,
# empty runtime-writable dirs (output, HOME, webpack cache). We deliberately do
# NOT `chown -R` over .next or the Remotion chrome tree: in overlayfs a
# recursive chown copies every touched file into a fresh layer, which here
# duplicated ~470MB (.next + chrome) for no functional benefit.
#   - .next is already node-owned via `COPY --chown` above.
#   - The Remotion chrome under .remotion is root-owned but world a+rx (default
#     umask 022 plus the explicit `chmod +x` on the binary), so the node user
#     can read and execute it. We only chmod the .remotion *directory* 777 so a
#     stray write (none expected once chrome is pre-placed) can still succeed.
# Remotion resolves its chrome cache to <nearest-package.json>/node_modules/.remotion
# from the SERVER's runtime cwd (/app/apps/web), not the image build dir (/app).
# The binary lives at /app/node_modules/.remotion (pre-placed above); expose it at the
# path the server actually probes so ensureBrowser() finds it and skips the download.
ENV HOME=/home/node
RUN mkdir -p /app/output /home/node \
      /app/node_modules/.remotion \
      /app/packages/templates/node_modules/.cache && \
    chown -R node:node /app/output /home/node \
      /app/packages/templates/node_modules/.cache && \
    chmod 777 /app/node_modules/.remotion && \
    mkdir -p /app/apps/web/node_modules && \
    ln -sfnT /app/node_modules/.remotion /app/apps/web/node_modules/.remotion
USER node

EXPOSE 3000

# Docker Compose / `docker run` health; Kubernetes uses its own probes against
# the same endpoints. global fetch is available on Node 22.
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD node -e "fetch('http://127.0.0.1:3000/api/health/live').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

WORKDIR /app/apps/web
CMD ["/app/node_modules/.bin/next", "start"]