# syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
ARG NODE_IMAGE=node:22-bookworm-slim@sha256:53ada149d435c38b14476cb57e4a7da73c15595aba79bd6971b547ceb6d018bf
# Native addons are compiled only in target-platform toolchain stages. Each
# install-links closure remains independent and receives no source for the other
# long-running component.
FROM --platform=$TARGETPLATFORM ${NODE_IMAGE} AS blind-native-toolchain
RUN apt-get update && \
apt-get install -y --no-install-recommends g++ make python3 && \
rm -rf /var/lib/apt/lists/*
FROM blind-native-toolchain AS blind-edge-toolchain
ARG TARGETARCH
WORKDIR /opt/hiverelay/deploy/blind/edge
COPY deploy/blind/edge/package.json ./package.json
COPY deploy/blind/edge/package-lock.json ./package-lock.json
COPY packages/blind-protocol /opt/hiverelay/packages/blind-protocol
COPY packages/blind-ipc /opt/hiverelay/packages/blind-ipc
COPY packages/blind-peercred /opt/hiverelay/packages/blind-peercred
COPY packages/blind-edge /opt/hiverelay/packages/blind-edge
RUN printf '%s\n' "$TARGETARCH" > /opt/hiverelay/peercred-target-architecture && \
npm_config_build_from_source=true npm ci --omit=dev --install-links --no-audit --no-fund && \
npm cache clean --force && \
test ! -e node_modules/@hiverelay/blind-daemon && \
test -f node_modules/@hiverelay/blind-peercred/build/Release/blind_peercred.node && \
node -e "import('@hiverelay/blind-peercred').then(m => { if (typeof m.socketPeerCredentials !== 'function') process.exit(1) })"
FROM blind-native-toolchain AS blind-daemon-toolchain
ARG TARGETARCH
WORKDIR /opt/hiverelay/deploy/blind/daemon
COPY deploy/blind/daemon/package.json ./package.json
COPY deploy/blind/daemon/package-lock.json ./package-lock.json
COPY packages/blind-protocol /opt/hiverelay/packages/blind-protocol
COPY packages/blind-ipc /opt/hiverelay/packages/blind-ipc
COPY packages/blind-peercred /opt/hiverelay/packages/blind-peercred
COPY packages/blind-daemon /opt/hiverelay/packages/blind-daemon
RUN printf '%s\n' "$TARGETARCH" > /opt/hiverelay/peercred-target-architecture && \
npm_config_build_from_source=true npm ci --omit=dev --install-links --no-audit --no-fund && \
npm cache clean --force && \
test ! -e node_modules/@hiverelay/blind-edge && \
test -f node_modules/@hiverelay/blind-peercred/build/Release/blind_peercred.node && \
node -e "import('@hiverelay/blind-peercred').then(m => { if (typeof m.socketPeerCredentials !== 'function') process.exit(1) })"
FROM --platform=$TARGETPLATFORM ${NODE_IMAGE} AS blind-edge
ARG HIVERELAY_BLIND_BUNDLE_ID=unreleased
LABEL org.opencontainers.image.title="HiveRelay Blind Edge" \
org.opencontainers.image.description="Public metadata-stripping transport edge for the blind app substrate" \
org.opencontainers.image.licenses="Apache-2.0" \
org.opencontainers.image.hiverelay.product-mode="BLIND_APPLICATION_SUBSTRATE_V1" \
org.opencontainers.image.hiverelay.component="edge" \
org.opencontainers.image.hiverelay.bundle-id="${HIVERELAY_BLIND_BUNDLE_ID}"
RUN groupadd --system --gid 997 hiverelay-blind && \
useradd --system --uid 998 --gid hiverelay-blind --home-dir /nonexistent --shell /usr/sbin/nologin hiverelay-edge && \
install -d -o 999 -g 997 -m 0750 /run/hiverelay-blind && \
install -d -o 998 -g 997 -m 0550 /opt/hiverelay/edge
WORKDIR /opt/hiverelay/edge
COPY --from=blind-edge-toolchain /opt/hiverelay/deploy/blind/edge/node_modules ./node_modules
COPY --from=blind-edge-toolchain --chown=0:0 --chmod=0444 /opt/hiverelay/peercred-target-architecture ./peercred-target-architecture
COPY --chown=0:0 --chmod=0444 deploy/blind/edge/healthcheck.mjs ./healthcheck.mjs
ENV NODE_ENV=production \
HIVERELAY_BLIND_RUNTIME_DIR=/run/hiverelay-blind \
HIVERELAY_BLIND_UNARY_SOCKET=/run/hiverelay-blind/unary.sock \
HIVERELAY_BLIND_STREAM_SOCKET=/run/hiverelay-blind/stream.sock \
HIVERELAY_BLIND_HOST=0.0.0.0 \
HIVERELAY_BLIND_PORT=9100 \
HIVERELAY_BLIND_DAEMON_UID=999 \
HIVERELAY_BLIND_DAEMON_GID=997 \
HIVERELAY_BLIND_SHARED_GID=997 \
HIVERELAY_BLIND_TLS_KEY=/run/secrets/hiverelay-blind-tls.key \
HIVERELAY_BLIND_TLS_CERT=/run/secrets/hiverelay-blind-tls.crt
VOLUME ["/run/hiverelay-blind"]
EXPOSE 9100
USER 998:997
HEALTHCHECK --interval=5s --timeout=2s --start-period=5s --retries=12 \
CMD ["node", "/opt/hiverelay/edge/healthcheck.mjs"]
ENTRYPOINT ["node", "/opt/hiverelay/edge/node_modules/@hiverelay/blind-edge/cli.js"]
FROM --platform=$TARGETPLATFORM ${NODE_IMAGE} AS blind-daemon
ARG HIVERELAY_BLIND_BUNDLE_ID=unreleased
LABEL org.opencontainers.image.title="HiveRelay Blind Daemon" \
org.opencontainers.image.description="Private canonical dispatcher, storage, and signing daemon for the blind app substrate" \
org.opencontainers.image.licenses="Apache-2.0" \
org.opencontainers.image.hiverelay.product-mode="BLIND_APPLICATION_SUBSTRATE_V1" \
org.opencontainers.image.hiverelay.component="daemon" \
org.opencontainers.image.hiverelay.bundle-id="${HIVERELAY_BLIND_BUNDLE_ID}"
RUN groupadd --system --gid 997 hiverelay-blind && \
useradd --system --uid 999 --gid hiverelay-blind --home-dir /data/blind --shell /usr/sbin/nologin hiverelay-daemon && \
install -d -o 999 -g 997 -m 0750 /run/hiverelay-blind && \
install -d -o 999 -g 997 -m 0700 /data/blind && \
install -d -o 999 -g 997 -m 0550 /opt/hiverelay/daemon
WORKDIR /opt/hiverelay/daemon
COPY --from=blind-daemon-toolchain /opt/hiverelay/deploy/blind/daemon/node_modules ./node_modules
COPY --from=blind-daemon-toolchain --chown=0:0 --chmod=0444 /opt/hiverelay/peercred-target-architecture ./peercred-target-architecture
COPY --chown=0:0 --chmod=0444 deploy/blind/daemon/healthcheck.mjs ./healthcheck.mjs
ENV NODE_ENV=production \
HIVERELAY_BLIND_RUNTIME_DIR=/run/hiverelay-blind \
HIVERELAY_BLIND_UNARY_SOCKET=/run/hiverelay-blind/unary.sock \
HIVERELAY_BLIND_STREAM_SOCKET=/run/hiverelay-blind/stream.sock \
HIVERELAY_BLIND_DATA=/data/blind \
HIVERELAY_BLIND_EDGE_UID=998 \
HIVERELAY_BLIND_DAEMON_UID=999 \
HIVERELAY_BLIND_DAEMON_GID=997 \
HIVERELAY_BLIND_SHARED_GID=997
VOLUME ["/run/hiverelay-blind", "/data/blind"]
USER 999:997
HEALTHCHECK --interval=5s --timeout=2s --start-period=5s --retries=12 \
CMD ["node", "/opt/hiverelay/daemon/healthcheck.mjs"]
ENTRYPOINT ["node", "/opt/hiverelay/daemon/node_modules/@hiverelay/blind-daemon/cli.js"]