fix: Docker build installs curl, keeps tsx, optimizes layers

- Add curl to apt-get (needed by setup-curl.ts and full-update.ts)
- Re-add tsx after prune (needed at runtime by update-checker fork)
- Separate web deps layer for better cache efficiency
- Add env_file to docker-compose.yml for .env pass-through
- Default .env.example to linux/x64 for Docker users
- Expand .dockerignore to exclude .env*, *.md, scripts/poc-*

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.dockerignore

@@ -7,4 +7,7 @@ tmp/
 .git/
 docs/
 stitch-*/
+*.md
 .env
+.env.*
+scripts/poc-*

.env.example

@@ -1,17 +1,4 @@
-# Codex Proxy environment configuration
-# Copy to .env and adjust:  cp .env.example .env
-
-# ── Authentication ──
-CODEX_JWT_TOKEN=       # Optional: paste ChatGPT JWT directly (skip OAuth)
-
-# ── Platform (for fingerprint headers) ──
-CODEX_PLATFORM=darwin  # darwin/win32/linux
-CODEX_ARCH=arm64       # arm64/x64
-
-# ── Port ──
+CODEX_JWT_TOKEN=       # Optional: paste ChatGPT JWT (skip OAuth login)
+CODEX_PLATFORM=linux   # linux for Docker, darwin for macOS, win32 for Windows
+CODEX_ARCH=x64         # x64 for Docker/Intel, arm64 for Apple Silicon
 PORT=8080
-
-# ── Docker runtime proxy ──
-# The container needs a proxy to reach chatgpt.com.
-# host.docker.internal resolves to the Docker host machine.
-# CONTAINER_PROXY=http://host.docker.internal:7890

Dockerfile

@@ -1,30 +1,34 @@
 FROM node:20-slim
 
-# Install unzip (full-update pipeline), curl, and ca-certificates
+# curl: needed by setup-curl.ts and full-update.ts
+# unzip: needed by full-update.ts to extract Codex.app
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends unzip curl ca-certificates && \
+    apt-get install -y --no-install-recommends curl unzip ca-certificates && \
     rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 
-# Copy everything first (postinstall needs scripts/setup-curl.ts)
-COPY . .
-
-# Install backend dependencies (postinstall downloads curl-impersonate)
+# 1) Backend deps (postinstall downloads curl-impersonate for Linux)
+COPY package*.json ./
 RUN npm ci
 
-# Build frontend (Vite → public/)
-RUN cd web && npm ci && npm run build
+# Fail fast if curl-impersonate wasn't downloaded
+RUN test -f bin/curl-impersonate || \
+    (echo "FATAL: curl-impersonate not downloaded. Check network." && exit 1)
 
-# Build backend (TypeScript → dist/)
-RUN npx tsc
+# 2) Web deps (separate layer for cache efficiency)
+COPY web/package*.json web/
+RUN cd web && npm ci
 
-# Prune dev dependencies
-RUN npm prune --omit=dev
+# 3) Copy source
+COPY . .
 
-# Persistent data mount point
-VOLUME /app/data
+# 4) Build frontend (Vite → public/) + backend (tsc → dist/)
+RUN cd web && npm run build && cd .. && npx tsc
 
-EXPOSE 8080
+# 5) Prune dev deps, re-add tsx (needed at runtime by update-checker fork())
+RUN npm prune --omit=dev && npm install --no-save tsx
 
+VOLUME /app/data
+EXPOSE 8080
 CMD ["node", "dist/index.js"]

docker-compose.yml

@@ -1,21 +1,13 @@
 services:
   codex-proxy:
-    build:
-      context: .
-      # Use host network during build so npm/curl can reach proxy at 127.0.0.1
-      network: host
+    build: .
     ports:
       - "${PORT:-8080}:8080"
     volumes:
       - ./data:/app/data
       - ./config:/app/config
     restart: unless-stopped
+    env_file:
+      - .env
     environment:
       - NODE_ENV=production
-      # Runtime proxy for upstream requests (chatgpt.com)
-      - HTTP_PROXY=${CONTAINER_PROXY:-}
-      - HTTPS_PROXY=${CONTAINER_PROXY:-}
-      - NO_PROXY=localhost,127.0.0.1
-    extra_hosts:
-      # Allow container to reach host network services (proxy, etc.)
-      - "host.docker.internal:host-gateway"