deepseek-harness/Dockerfile

FROM node:22-bookworm

# Install Nginx, DBus, and Gnome Keyring for headless OS credential storage
RUN apt-get update && apt-get install -y \
    nginx-light \
    dbus-x11 \
    gnome-keyring \
    libsecret-1-0 \
    libsecret-1-dev \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Enable pnpm
RUN corepack enable && corepack prepare pnpm@latest --activate

# Copy code and build
COPY . .
RUN pnpm install
RUN pnpm run build

# Create default directories
RUN mkdir -p /app/workspaces /root/.local/share/keyrings

# Configure Nginx proxy to force local spoofing behind Dokploy/Traefik
RUN cat << 'EOF' > /etc/nginx/sites-available/default
server {
    listen 3080;
    location / {
        proxy_pass http://127.0.0.1:3081;
        proxy_set_header Host 127.0.0.1:3081;
        proxy_set_header Origin http://127.0.0.1:3081;
        proxy_set_header Referer http://127.0.0.1:3081/;
        proxy_set_header X-Real-IP 127.0.0.1;
        proxy_set_header X-Forwarded-For 127.0.0.1;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}
EOF

# Create startup script via Heredoc to prevent shell syntax errors
RUN cat << 'EOF' > /app/entrypoint.sh
#!/bin/bash
nginx
eval $(dbus-launch --sh-syntax)
export DBUS_SESSION_BUS_ADDRESS
eval $(echo "" | gnome-keyring-daemon --unlock --components=secrets)
export GNOME_KEYRING_CONTROL
exec node --import tsx/esm apps/cli/src/bin.ts web --port 3081 --no-open
EOF

RUN chmod +x /app/entrypoint.sh

EXPOSE 3080

CMD ["/app/entrypoint.sh"]