Dockerfile

# Dockerfile -- HF Space deployment (v10: .dockerignore + optimized sleep)
# rebuild-20260620-v03
FROM node:22-bookworm-slim

# 1. System deps + Python deps + OpenViking server + pguser + pg0 (merged RUN)
RUN apt-get update && apt-get install -y --no-install-recommends \
    python3 python3-pip ca-certificates curl openssl tzdata \
    && rm -rf /var/lib/apt/lists/* \
    && useradd -m -s /bin/bash pguser \
    && pip3 install --no-cache-dir --break-system-packages \
    requests huggingface_hub bcrypt \
    "openviking[bot]" --upgrade --force-reinstall \
    hindsight-embed uv pg0-embedded

# 1b. Set pg0 PostgreSQL binaries to run as pguser via setuid (not pg0 itself)
RUN python3 << 'PYEOF'
import os, pathlib, stat, pwd
try:
    import pg0
    pguser = pwd.getpwnam('pguser')
    uid = pguser.pw_uid
    bin_dir = pathlib.Path(pg0.__file__).parent / 'bin'
    if not bin_dir.exists():
        print('pg0 bin dir not found')
    else:
        for bin_path in bin_dir.iterdir():
            if bin_path.is_file():
                name = bin_path.name
                # pg0 binary itself stays root; only postgresql sub-tools need setuid
                if name in ('initdb', 'pg_ctl', 'postgres', 'postmaster', 'pg_config', 'pg_resetwal', 'pg_isready', 'pg_basebackup', 'pg_rewind', 'pg_checksums'):
                    os.chown(str(bin_path), uid, -1)
                    bin_path.chmod(bin_path.stat().st_mode | stat.S_ISUID)
                    print(f'setuid pguser: {name}')
        print('pg0 setuid done')
except ImportError:
    print('pg0 not installed')
PYEOF

# 1c. Install Caddy (lightweight reverse proxy) — download at build time to avoid LFS issues
RUN curl -fsSL "https://github.com/caddyserver/caddy/releases/download/v2.7.6/caddy_2.7.6_linux_amd64.tar.gz" -o /tmp/caddy.tar.gz \
    && tar -xzf /tmp/caddy.tar.gz -C /usr/bin caddy \
    && chmod +x /usr/bin/caddy \
    && rm /tmp/caddy.tar.gz

# 2a. Install OpenClaw CLI + pre-download WeChat plugin + cache bust (merged RUN)
ENV OPENCLAW_STATE_DIR=/root/.openclaw
RUN npm install -g openclaw@latest --unsafe-perm --no-audit --no-fund \
    && mkdir -p /root/.openclaw \
    && openclaw plugins install "@tencent-weixin/openclaw-weixin" --no-audit --no-fund 2>/dev/null || true \
    && openclaw plugins install clawhub:@openviking/openclaw-plugin --no-audit --no-fund 2>/dev/null || true \
    && npm install -g @vectorize-io/hindsight-openclaw --registry https://registry.npmjs.org --no-audit --no-fund 2>/dev/null || true \
    && echo "bust-20260620-v08"

# 3. Copy app files
WORKDIR /app
COPY backup-manager.py config-generator.py start-openclaw.sh control-server.py control.html ./
COPY scripts/feishu-setup.sh scripts/install-programs.sh scripts/wechat-activate.sh ./scripts/
RUN chmod +x start-openclaw.sh scripts/*.sh

# 4. Environment
ENV PORT=7860 \
    HOME=/root \
    TZ=Asia/Shanghai \
    NODE_OPTIONS=--max-old-space-size=4096 \
    NPM_CONFIG_REGISTRY=https://registry.npmmirror.com \
    NODE_ENV=production \
    PYTHONUNBUFFERED=1 \
    PYTHONIOENCODING=utf-8

EXPOSE 7860
CMD ["./start-openclaw.sh"]