Dockerfile

# freerouter gateway image — multi-stage, pure-Go (no CGO).
#
# The build uses CGO_ENABLED=0 because freerouter's SQLite backend is the pure-Go
# modernc.org/sqlite driver: no libsqlite, no gcc, no system libraries. That keeps the
# runtime stage a static binary on distroless — nothing to patch, nothing to link.

# --- web stage -------------------------------------------------------------------
# Builds the marketplace SPA (freerouter-04a) so the prod image serves the UI single-origin,
# exactly like the cmd/e2egateway harness. Its only output the runtime stage needs is
# web/dist — the node toolchain itself never reaches the runtime image.
FROM node:22-alpine AS web
WORKDIR /web
COPY web/package*.json ./
RUN npm ci
COPY web/ ./
RUN npm run build

# --- build stage ---------------------------------------------------------------
FROM golang:1.26 AS build
WORKDIR /src

# Cache modules first for faster rebuilds.
COPY go.mod go.sum ./
RUN go mod download

# Build the static binary. CGO_ENABLED=0 is load-bearing (see above).
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags='-s -w' \
    -o /out/freerouter ./cmd/freerouter

# Stage a /data directory owned by the distroless nonroot uid (65532). A named
# volume mounted over /data inherits this ownership, so the container can write
# the SQLite meter file without running as root.
RUN mkdir -p /data && chown 65532:65532 /data

# --- runtime stage -------------------------------------------------------------
# distroless/static: no shell, no package manager, just the static binary + certs.
FROM gcr.io/distroless/static-debian12:nonroot
WORKDIR /data

# The SQLite meter file lives under /data, which docker-compose mounts as a named
# volume so the ledger survives container restarts (FREEROUTER_METER_DSN points here).
ENV FREEROUTER_METER_DSN=/data/freerouter-meter.db
ENV FREEROUTER_LISTEN_ADDR=:8080

# The built SPA (freerouter-04a) — cmd/freerouter mounts it single-origin in front of the
# API via internal/webui.Composite when FREEROUTER_DIST_DIR/index.html exists.
ENV FREEROUTER_DIST_DIR=/web

COPY --from=build --chown=65532:65532 /data /data
COPY --from=build /out/freerouter /usr/local/bin/freerouter
COPY --from=web /web/dist /web

EXPOSE 8080
USER nonroot:nonroot
ENTRYPOINT ["/usr/local/bin/freerouter"]