Dockerfile

ARG BUILD_ENV=development
ARG PROD_ASSETS
ARG OMNIOUT_TOKEN
FROM node:22 AS node_base
FROM python:3.12-slim-bookworm

# Re-import build args inside this stage. ARGs declared before the first
# FROM are only in scope for FROM lines themselves; they reset to undefined
# after each FROM and must be redeclared to be visible to RUN.
ARG BUILD_ENV=development
ARG PROD_ASSETS
ARG OMNIOUT_TOKEN

# Node and npm
COPY --from=node_base /usr/local/lib/node_modules /usr/local/lib/node_modules
COPY --from=node_base /usr/local/bin/node /usr/local/bin/node
COPY --from=node_base /opt/yarn-* /opt/yarn
RUN ln -s /usr/local/lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack
RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm
RUN ln -s /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx
RUN ln -s /opt/yarn/bin/yarn /usr/local/bin/yarn
RUN ln -s /opt/yarn/bin/yarnpkg /usr/local/bin/yarnpkg
RUN node --version && npm --version && yarn --version

# System setup:
# slim base lacks compilers and -dev headers needed to build wheels
# for cryptography, lxml, psycopg2-binary, etc. Add toolchain deps.
RUN apt-get update \
  && apt-get install -y --no-install-recommends \
       gettext \
       redis-tools \
       build-essential \
       libxml2-dev \
       libxslt-dev \
       libpq-dev \
       libffi-dev \
       curl \
       gnupg \
       ca-certificates \
  && apt-get clean \
  && rm -rf /var/lib/apt/lists/*

# Google Chrome stable for the VBT (Vlocity Build Tool) compiler invoked
# by the worker dyno during installs of OmniStudio products. Replaces the
# heroku/google-chrome buildpack from the buildpack-stack era. The worker
# startup symlinks /app/.apt/usr/bin/google-chrome (the legacy path VBT
# expects); recreate that exact path here.
RUN curl -fsSL https://dl.google.com/linux/linux_signing_key.pub \
       | gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg \
  && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] https://dl.google.com/linux/chrome/deb/ stable main" \
       > /etc/apt/sources.list.d/google-chrome.list \
  && apt-get update \
  && apt-get install -y --no-install-recommends google-chrome-stable \
  && mkdir -p /app/.apt/usr/bin \
  && ln -s /usr/bin/google-chrome /app/.apt/usr/bin/google-chrome \
  && apt-get clean \
  && rm -rf /var/lib/apt/lists/*

# Python context setup:
# setuptools<81 keeps the legacy pkg_resources.declare_namespace API
# that cumulusci's __init__ relies on. The full python:3.12 image
# ships an older setuptools by default; slim does not, so pin it.
RUN pip install --no-cache-dir --upgrade pip pip-tools "setuptools<81"

# ================ ENVIRONMENT
ENV PYTHONUNBUFFERED=1
ENV PYTHONDONTWRITEBYTECODE=1

WORKDIR /app

# Env setup:
ENV PYTHONPATH=/app
ENV DJANGO_SETTINGS_MODULE=config.settings.production
ENV OMNIOUT_TOKEN=${OMNIOUT_TOKEN}

# Install sfdx
RUN npm install --location=global sfdx-cli --ignore-scripts

# Python requirements:
# setuptools<81 repeated here because --upgrade pip-tools would otherwise
# re-resolve setuptools to >=81 in this layer; the pin must survive both
# pip-install invocations (see the earlier toolchain layer for the full why).
COPY ./requirements requirements
RUN pip install --no-cache-dir --upgrade pip pip-tools "setuptools<81" \
    && pip install --no-cache-dir -r requirements/prod.txt
RUN pip install --no-cache-dir -r requirements/dev.txt

# JS client setup:
COPY ./.npmrc .npmrc
COPY ./package.json package.json
COPY ./yarn.lock yarn.lock
RUN yarn install --ignore-optional --check-files

COPY . /app

# Avoid building prod assets in development
RUN if [ "${BUILD_ENV}" = "production" ] || [ -n "${PROD_ASSETS}" ] ; then yarn prod ; else mkdir -p dist/prod ; fi

# This is not a real key! It is present because we need a key
# that matches the structure of the real value to launch the application.
RUN \
  DB_ENCRYPTION_KEY="Ul-OySkEawSxUc7Ck13Twu2109IzIFh54C1WXO9KAFE=" \
  GITHUB_TOKEN="sample token" \
  SFDX_CLIENT_SECRET="sample secret" \
  SFDX_CLIENT_CALLBACK_URL="sample callback" \
  SFDX_CLIENT_ID="sample id" \
  python manage.py collectstatic --noinput

CMD ["sh", "-c", "exec daphne --bind 0.0.0.0 --port $PORT metadeploy.asgi:application"]