FROM node:22-alpine AS web-builder
WORKDIR /src/web
COPY web/package.json web/package-lock.json ./
RUN npm ci --include=dev
COPY web/ ./
RUN rm -f tsconfig*.tsbuildinfo && npm run build

FROM golang:1.24-alpine AS go-builder
WORKDIR /src
RUN apk add --no-cache ca-certificates git
COPY go.mod go.sum* ./
RUN go mod download
COPY . .
COPY --from=web-builder /src/web/dist ./web/dist
RUN CGO_ENABLED=0 GOOS=linux go build \
    -trimpath \
    -ldflags="-s -w" \
    -o /out/subpool ./cmd/subpool

FROM alpine:3.22
ARG CODEX_CLI_VERSION=0.156.1
USER root
RUN apk add --no-cache ca-certificates tzdata nodejs npm tini \
    && npm install -g "@openai/codex@${CODEX_CLI_VERSION}" \
    && npm cache clean --force \
    && addgroup -g 10001 subpool \
    && adduser -D -u 10001 -G subpool subpool
WORKDIR /app
COPY --from=go-builder /out/subpool /usr/local/bin/subpool
COPY --from=web-builder /src/web/dist ./web/dist
USER subpool
EXPOSE 8080 8081
ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/subpool"]