Dockerfile

# Base images are pinned by digest, not by a floating tag. "node:alpine" and
# "alpine" resolved to whatever was published that day, so two builds of the
# same commit could differ, and a bad upstream push reached every build at once.
# The tag is kept alongside the digest so it is obvious what is pinned; the
# digest is what docker enforces.
FROM --platform=$BUILDPLATFORM node:26-alpine@sha256:ef24c5053d50fdc3e4e56eb4e7ddb7861874ab0fdc797046ba897581deb8e868 AS front-builder
WORKDIR /app
COPY frontend/ ./
RUN npm install && npm run build

FROM golang:1.26-alpine@sha256:ce864e7223ac17b1775e6fd0b4c0db580c2eb50e7953a427916379e4b92a1628 AS backend-builder
WORKDIR /app
ARG TARGETARCH
ARG TARGETVARIANT
ENV CGO_ENABLED=1
ENV CGO_CFLAGS="-D_LARGEFILE64_SOURCE"
ENV GOARCH=$TARGETARCH

RUN apk upgrade --no-cache --scripts=no apk-tools && \
    apk add --no-cache \
    gcc \
    musl-dev \
    libc-dev \
    make \
    git \
    wget \
    unzip \
    bash \
    curl

ENV CC=gcc

RUN CRONET_ARCH="$TARGETARCH" && \
    CRONET_URL="https://github.com/SagerNet/cronet-go/releases/latest/download/libcronet-linux-${CRONET_ARCH}.so"; \
    echo "Downloading $CRONET_URL" && \
    wget -q -O ./libcronet.so "$CRONET_URL" && \
    chmod 755 ./libcronet.so

COPY . .
COPY --from=front-builder /app/dist/ /app/web/html/

RUN if [ "$TARGETARCH" = "arm" ]; then export GOARM=7; [ "$TARGETVARIANT" = "v6" ] && export GOARM=6; fi; \
    . ./build-tags.sh && \
    TAGS=$(tags_for docker) && \
    LDFLAGS=$(ldflags_for docker) && \
    go build -ldflags="$LDFLAGS" -tags "$TAGS" -o sui main.go

FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
LABEL org.opencontainers.image.authors="alireza7@gmail.com"
ENV TZ=Asia/Tehran
WORKDIR /app
RUN set -ex && apk upgrade --no-cache --scripts=no apk-tools && \
    apk add --no-cache --upgrade bash ca-certificates nftables su-exec && \
    addgroup -S -g 10001 sui && \
    adduser -S -u 10001 -G sui -h /app -s /sbin/nologin sui
COPY --from=backend-builder /app/sui /app/libcronet.so /app/
COPY entrypoint.sh /app/

# Asks the binary, which reads the port the operator actually configured. A
# check with the port written in here goes red the moment they change it in the
# panel, and an orchestrator then kills a container that was working.
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
    CMD ["./sui", "healthcheck"]

# The container still starts as root by default: a TUN inbound needs
# CAP_NET_ADMIN in the process's permitted set, and a panel port below 1024
# needs CAP_NET_BIND_SERVICE. Flipping the default would break both, silently,
# on every existing deployment. Set SUI_UID (and optionally SUI_GID) to have
# entrypoint.sh hand over to an unprivileged user instead -- see entrypoint.sh.
ENTRYPOINT [ "./entrypoint.sh" ]