halkyon/halkyon_learn_server/Dockerfile

# The server image. Built from the repository root (the build context), because the
# workspace's root pubspec and lockfile live there:
#
#   docker build -f halkyon_learn_server/Dockerfile .
#
# Based on Serverpod's template, with three changes: Dart 3.13 (our SDK floor), an
# Ubuntu 24.04 runtime instead of alpine + Dart's minimal glibc runtime (same
# distribution as our servers; complete glibc, which Serverpod 4's bundled SQLite
# libraries need), and a start command that passes Docker's stop signal on.

# ── Build stage: compile the server to a native executable ────────────────────────
FROM dart:3.13.4 AS build
WORKDIR /app
COPY pubspec.yaml pubspec.lock ./
COPY halkyon_learn_server halkyon_learn_server

# The workspace root with only the server package: the client package isn't needed to
# build the server, and the Flutter app would need Flutter. Everything else stays as the
# repository has it, above all the dependency overrides, without which the offline sync
# package's exact Serverpod pin can't be resolved. The check fails the build loudly if
# the root's member list changes shape.
RUN sed -i -e '/^  - halkyon_learn_client$/d' -e '/^  - halkyon_learn_flutter$/d' pubspec.yaml \
 && grep -q '^  - halkyon_learn_server$' pubspec.yaml \
 && ! grep -q -e 'halkyon_learn_client' -e 'halkyon_learn_flutter' pubspec.yaml
RUN dart pub get
WORKDIR /app/halkyon_learn_server
RUN dart build cli --target bin/main.dart --output build
RUN mv build/bundle/bin/main build/bundle/bin/server
RUN mkdir -p config migrations

# ── Runtime stage ─────────────────────────────────────────────────────────────────
# Ubuntu 24.04: glibc 2.39 (the bundled binaries need at most 2.34, measured) and
# libgcc_s (needed by libsqlite3_connection_pool, a Rust library; a server running
# against Postgres never loads it, but a future code path might). CA certificates
# for outgoing TLS, e.g. GitHub sign-in.
FROM ubuntu:24.04
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates \
 && rm -rf /var/lib/apt/lists/*
WORKDIR /app

ENV runmode=production
ENV serverid=default
ENV logging=normal
ENV role=monolith

COPY --from=build /app/halkyon_learn_server/build/bundle/ ./
COPY --from=build /app/halkyon_learn_server/config/ config/
COPY --from=build /app/halkyon_learn_server/migrations/ migrations/
COPY --from=build /app/halkyon_learn_server/lib/src/generated/protocol.yaml lib/src/generated/protocol.yaml

# The server needs no root rights (it listens on 8080 and writes nothing to the
# image), so it runs as an unprivileged system user.
RUN useradd --system --no-create-home --shell /usr/sbin/nologin app
USER app

# Only the API server runs in production (no Insights, no web server).
EXPOSE 8080

# `exec` makes the server PID 1, so it receives Docker's SIGTERM and shuts down
# cleanly; extra arguments (e.g. --apply-migrations) come from the container command.
ENTRYPOINT ["/bin/sh", "-c", "exec ./bin/server --mode=$runmode --server-id=$serverid --logging=$logging --role=$role \"$@\"", "--"]
CMD []