halkyon/apps/learn/halkyon_learn_curator/Dockerfile

# The dictionaries' image: the curator, keeping a server's dictionary files current
# from EDRDG's files of the day (`curate update`, the README). Built from the
# repository root (the build context), where the workspace's root pubspec and lockfile
# live:
#
#   docker build -f halkyon_learn_curator/Dockerfile .
#
# A container of its own beside the server (deploy/compose.yaml, decided 2026-10-09):
# the curator (AGPL) never enters the server's image or process, and a conversion
# that fails can't touch the server. They share only the folder of files.

# ── Build stage: compile the curator to a native executable ───────────────────────
FROM dart:3.13.4 AS build
WORKDIR /app
COPY pubspec.yaml pubspec.lock ./
COPY halkyon_learn_curator halkyon_learn_curator

# The workspace root with only the curator package, as the server's Dockerfile does it
# with the server's. The check fails the build loudly if the member list changes shape.
RUN sed -i -e '/^  - halkyon_learn_client$/d' -e '/^  - halkyon_learn_flutter$/d' \
      -e '/^  - halkyon_learn_server$/d' pubspec.yaml \
 && grep -q '^  - halkyon_learn_curator$' pubspec.yaml \
 && ! grep -q -e 'halkyon_learn_client' -e 'halkyon_learn_flutter' \
      -e 'halkyon_learn_server' pubspec.yaml
RUN dart pub get
WORKDIR /app/halkyon_learn_curator
RUN dart build cli --target bin/curate.dart --output build

# ── Runtime stage ─────────────────────────────────────────────────────────────────
# Ubuntu 24.04 as the server's, with CA certificates for EDRDG's HTTPS, and MeCab's
# IPADIC, which the package compiles as it is installed: the curator packs it for the
# app's devices (ADR 0012). Its sources go once it is compiled.
FROM ubuntu:24.04
RUN apt-get update \
 && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
      ca-certificates mecab-ipadic-utf8 \
 && test -s /var/lib/mecab/dic/ipadic-utf8/sys.dic \
 && rm -rf /usr/share/mecab/dic/ipadic /var/lib/apt/lists/*
WORKDIR /app

COPY --from=build /app/halkyon_learn_curator/build/bundle/ ./
COPY --from=build /app/halkyon_learn_curator/data/ data/

# An unprivileged user of its own: user ID 10001, shared with neither the containers
# of PostgreSQL and the server (999) nor the CI runner on the host (61000). The folder
# it writes into belongs to it, which a new volume mounted there takes over.
RUN useradd --system --uid 10001 --no-create-home --shell /usr/sbin/nologin curator \
 && mkdir /dictionaries \
 && chown curator /dictionaries
USER curator

# Updates the files whenever they are a week old (EDRDG's licence asks at least
# monthly), and sleeps in between.
ENTRYPOINT ["./bin/curate", "update", "--into", "/dictionaries", "--data", "data"]
CMD ["--every", "7"]