# syntax=docker/dockerfile:1

# Maven 构建阶段使用与项目一致的 JDK 25，并利用 BuildKit 缓存减少重复下载依赖的时间。
FROM maven:3.9.13-eclipse-temurin-25@sha256:ade3c87e3cdfbe04932afa16b31814cbf60b0122d21d78a76530684a1eeb7cc2 AS builder

WORKDIR /workspace
COPY pom.xml ./
COPY manuagent-common/pom.xml manuagent-common/pom.xml
COPY manuagent-admin/pom.xml manuagent-admin/pom.xml
COPY manuagent-agent/pom.xml manuagent-agent/pom.xml
COPY manuagent-web/pom.xml manuagent-web/pom.xml
COPY src/main/resources/db ./src/main/resources/db
COPY manuagent-common/src ./manuagent-common/src
COPY manuagent-admin/src ./manuagent-admin/src
COPY manuagent-agent/src ./manuagent-agent/src
COPY manuagent-web/src ./manuagent-web/src
# 直接打包只解析项目真正需要的依赖；独立 go-offline 会额外下载大量未参与构建的报告插件。
RUN --mount=type=cache,target=/root/.m2 mvn -B -DskipTests package

# AgentScope DockerSandbox 通过 docker 命令创建 Runtime，直接复用官方镜像中的 CLI 二进制。
FROM docker:29-cli AS docker-cli

FROM eclipse-temurin:25.0.2_10-jre-jammy

# curl 用于容器健康检查；gosu 用于完成目录和 Docker Socket 权限初始化后降权运行 Java。
RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates curl gosu \
    && rm -rf /var/lib/apt/lists/*

COPY --from=docker-cli /usr/local/bin/docker /usr/local/bin/docker

RUN groupadd --gid 10001 manuagent \
    && useradd --uid 10001 --gid 10001 --create-home --shell /bin/bash manuagent \
    && mkdir -p /opt/manuagent /srv/manuagent/data \
    && chown -R manuagent:manuagent /opt/manuagent /srv/manuagent

WORKDIR /opt/manuagent
COPY --from=builder /workspace/manuagent-web/target/manuagent-web.jar app.jar
COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
RUN chmod 0755 /usr/local/bin/docker-entrypoint.sh

EXPOSE 8080

ENTRYPOINT ["docker-entrypoint.sh"]
CMD ["java", "-XX:MaxRAMPercentage=75.0", "-Djava.security.egd=file:/dev/urandom", "-jar", "/opt/manuagent/app.jar"]