Dockerfile

# ==========================================
# Stage 1: Build (Optimized for Speed/Size)
# ==========================================
FROM golang:1.25-alpine AS builder

RUN apk add --no-cache git gcc musl-dev

WORKDIR /build
RUN git clone https://github.com/Pro-mwas1234/arozos.git

WORKDIR /build/arozos/src

RUN go mod tidy && \
    CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o arozos

# ==========================================
# Stage 2: Runtime (Unlocked for 16GB RAM)
# ==========================================
FROM alpine:latest

# Install runtime deps, ffmpeg, and su-exec (for dropping root privileges)
RUN apk add --no-cache ca-certificates tzdata wget shadow ffmpeg su-exec && \
    rm -rf /var/cache/apk/*

# Create non-root user
RUN addgroup -S arozos && adduser -S arozos -G arozos

WORKDIR /app

# Copy binary
COPY --from=builder /build/arozos/src/arozos /app/arozos

# Copy source to get the web folder
COPY --from=builder /build/arozos /app/arozos-source

# Move web folder to correct location
RUN if [ -d "/app/arozos-source/web" ]; then \
      mv /app/arozos-source/web /app/web; \
    elif [ -d "/app/arozos-source/src/web" ]; then \
      mv /app/arozos-source/src/web /app/web; \
    fi

# Clean up source files
RUN rm -rf /app/arozos-source

# ==========================================
# PERSISTENCE SETUP
# ==========================================
# Create a separate /data directory for persistent storage (Users & Files)
RUN mkdir -p /data/sysdb /data/userfiles /app/logs

# Create symlinks so ArozOS thinks the data is in /app, but it's actually in /data
RUN ln -s /data/sysdb /app/sysdb && \
    ln -s /data/userfiles /app/userfiles

# Set initial ownership
RUN chown -R arozos:arozos /app /data

# Copy and set permissions for the entrypoint script
COPY entrypoint.sh /app/entrypoint.sh
RUN chmod +x /app/entrypoint.sh

EXPOSE 7860

# 🚀 GO RUNTIME TUNING for 16GB RAM / 2 vCPU
ENV PORT=7860 \
    HOST=0.0.0.0 \
    TZ=UTC \
    GOMAXPROCS=2 \
    GOMEMLIMIT=12GiB \
    GOGC=100

# NOTE: We do NOT set USER arozos here anymore. 
# The entrypoint.sh handles running as root first to fix permissions, then drops to arozos.

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD wget -q --spider http://localhost:7860/ || exit 1

# Use the entrypoint script instead of running arozos directly
CMD ["./entrypoint.sh"]