elizaos--eliza/packages/app-core/deploy/Dockerfile.cloud-agent

# syntax=docker/dockerfile:1.23
# ─────────────────────────────────────────────────────────────────────────────
# elizaOS Cloud Agent Container
# ─────────────────────────────────────────────────────────────────────────────

ARG APP_PORT=2138
ARG APP_BRIDGE_PORT=18790
ARG TAILSCALE_VERSION=1.90.8

# ─────────────────────────────────────────────────────────────────────────────
# Builder: precompile the standalone TS entrypoint to a single JS bundle so the
# runtime image starts with plain `node entrypoint.js` — no `tsx` transpile on
# the container cold-start path (issue #8812 F6). cloud-agent-shared.ts is
# inlined; the dynamic `@elizaos/*` imports stay external and resolve from
# /app/node_modules at runtime exactly as before.
# ─────────────────────────────────────────────────────────────────────────────
FROM node:24-bookworm-slim AS entrypoint-build
WORKDIR /build
COPY eliza/packages/app-core/deploy/cloud-agent-entrypoint.ts ./cloud-agent-entrypoint.ts
COPY eliza/packages/app-core/deploy/cloud-agent-shared.ts ./cloud-agent-shared.ts
# cloud-agent-shared.ts imports this via ../../shared/... in the repo layout.
# The builder copies TS files into /build, so mirror that relative path here for
# esbuild's resolver without adding a runtime dependency on @elizaos/shared.
COPY eliza/packages/shared/src/restart-exit-code.json /shared/src/restart-exit-code.json
RUN npx --yes esbuild@0.28.1 cloud-agent-entrypoint.ts \
      --bundle --platform=node --format=esm --target=node24 \
      --external:@elizaos/* --external:node:* \
      --outfile=entrypoint.js

FROM node:24-bookworm-slim

ARG APP_PORT
ARG APP_BRIDGE_PORT
ARG TAILSCALE_VERSION

RUN apt-get update && \
    apt-get install -y --no-install-recommends \
      curl ca-certificates gosu && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

RUN set -eux; \
  case "$(dpkg --print-architecture)" in \
    amd64) TAILSCALE_ARCH=amd64 ;; \
    arm64) TAILSCALE_ARCH=arm64 ;; \
    *) echo "Unsupported architecture for tailscale: $(dpkg --print-architecture)" >&2; exit 1 ;; \
  esac; \
  curl -fsSL "https://pkgs.tailscale.com/stable/tailscale_${TAILSCALE_VERSION}_${TAILSCALE_ARCH}.tgz" \
    -o /tmp/tailscale.tgz; \
  curl -fsSL "https://pkgs.tailscale.com/stable/tailscale_${TAILSCALE_VERSION}_${TAILSCALE_ARCH}.tgz.sha256" \
    -o /tmp/tailscale.tgz.sha256; \
  echo "$(cat /tmp/tailscale.tgz.sha256)  /tmp/tailscale.tgz" | sha256sum -c -; \
  tar -xzf /tmp/tailscale.tgz -C /tmp; \
  install -m 0755 "/tmp/tailscale_${TAILSCALE_VERSION}_${TAILSCALE_ARCH}/tailscale" /usr/local/bin/tailscale; \
  install -m 0755 "/tmp/tailscale_${TAILSCALE_VERSION}_${TAILSCALE_ARCH}/tailscaled" /usr/local/bin/tailscaled; \
  rm -rf /tmp/tailscale.tgz /tmp/tailscale.tgz.sha256 "/tmp/tailscale_${TAILSCALE_VERSION}_${TAILSCALE_ARCH}"

WORKDIR /app

# Copy the prebuilt JS entrypoint (cloud-agent-shared.ts inlined by the builder
# stage). The container runs this with plain `node` — no `tsx` transpile on the
# cold-start path.
COPY --from=entrypoint-build /build/entrypoint.js ./entrypoint.js
COPY eliza/packages/app-core/deploy/cloud-agent-docker-entrypoint.sh /usr/local/bin/cloud-agent-docker-entrypoint
RUN chmod +x /usr/local/bin/cloud-agent-docker-entrypoint

# Install elizaOS runtime + plugins so the dynamic imports inside
# cloud-agent-shared.ts resolve and the agent runs in REAL mode (not echo).
# Pinned to the `alpha` dist-tag per repo conventions. plugin-workflow and
# plugin-elizacloud are not installable from npm right now (the former is
# unpublished; the latter@alpha has an unpublished transitive @elizaos/cloud-sdk
# pin). The entrypoint already tolerates their absence.
RUN npm install --omit=dev --no-audit --no-fund --loglevel=error \
      @elizaos/core@alpha \
      @elizaos/plugin-sql@alpha \
    && npm cache clean --force

# Ensure the entrypoint can resolve packages from /app/node_modules
ENV NODE_PATH=/app/node_modules
ENV NODE_ENV=production
ENV PORT=${APP_PORT}
ENV BRIDGE_PORT=${APP_BRIDGE_PORT}

# Health check endpoint
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD curl -f http://localhost:${PORT}/health || exit 1

EXPOSE ${APP_PORT}
EXPOSE ${APP_BRIDGE_PORT}

# Security: the container starts as root only so the entrypoint can initialize
# Tailscale/Headscale when Cloud injects TS_AUTHKEY, then it drops to agent.
RUN useradd -m agent && chown -R agent:agent /app

ENTRYPOINT ["cloud-agent-docker-entrypoint"]
CMD ["node", "entrypoint.js"]