mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 04:12:10 +03:00
3214dc6be6
Reliability (D → A) — fix the 6 BUG findings:
- bin/cli/tray/autostart.mjs: replace `return ignoreFailure ? false : false`
(always-false ternary) with a meaningful branch that rethrows when
`ignoreFailure` is false.
- open-sse/services/combo.ts: reorder the quality-validation block so the
`combo.target.failed` emit runs BEFORE the `break` — the previous order
left the emit unreachable.
- src/app/api/playground/simulate-route/route.ts: drop the duplicate
`modelLower.includes("1m") || modelLower.includes("1m")` (and the 2m
twin) — both sides of the `||` were identical so the second check was
dead code.
- scripts/check/check-env-doc-sync.mjs: pass `localeCompare` to Array.sort
instead of relying on the default coercion-to-string ordering.
- src/sse/handlers/chat.ts: guard the cache TTL check with an explicit
`combosCachePromise !== null` so we don't evaluate a Promise as a
boolean.
Security (C → A) — close the Dockerfile hotspots:
- Builder stage now runs `npm ci`/`npm install` with `--ignore-scripts`
to neutralise transitive install-time RCE. OmniRoute's own postinstall
only rewrites a packaged `app/node_modules`, so it has nothing to do
during a fresh in-container install.
- Runner-base now drops to the baked-in `node` non-root user (UID/GID
1000) before the CMD runs. /app is chowned after all COPYs so the
runtime user can still read every file. The runner-cli stage briefly
elevates back to root for the apt + global npm installs and then
pins USER node again.
106 lines
4.6 KiB
Docker
106 lines
4.6 KiB
Docker
FROM node:24-trixie-slim AS builder
|
|
WORKDIR /app
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends libsecret-1-0 ca-certificates python3 make g++ \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY package*.json ./
|
|
COPY scripts/build/postinstall.mjs ./scripts/build/postinstall.mjs
|
|
COPY scripts/build/postinstallSupport.mjs ./scripts/build/postinstallSupport.mjs
|
|
COPY scripts/build/native-binary-compat.mjs ./scripts/build/native-binary-compat.mjs
|
|
ENV NPM_CONFIG_LEGACY_PEER_DEPS=true
|
|
# `--ignore-scripts` blocks the install/postinstall hooks of dependencies,
|
|
# closing the supply-chain attack surface where a transitive dep can run
|
|
# arbitrary code at install time. OmniRoute's own postinstall (better-sqlite3
|
|
# binary touchups, @swc/helpers copy) is only needed when a packaged
|
|
# `app/node_modules` is unpacked — inside the Docker builder we are doing a
|
|
# fresh native-platform install, so dropping the scripts is safe.
|
|
RUN if [ -f package-lock.json ]; then \
|
|
npm ci --no-audit --no-fund --legacy-peer-deps --ignore-scripts; \
|
|
else \
|
|
npm install --no-audit --no-fund --legacy-peer-deps --ignore-scripts; \
|
|
fi
|
|
|
|
COPY . ./
|
|
RUN mkdir -p /app/data && npm run build -- --webpack
|
|
|
|
FROM node:24-trixie-slim AS runner-base
|
|
WORKDIR /app
|
|
|
|
LABEL org.opencontainers.image.title="omniroute" \
|
|
org.opencontainers.image.description="Unified AI proxy — route any LLM through one endpoint" \
|
|
org.opencontainers.image.url="https://omniroute.online" \
|
|
org.opencontainers.image.source="https://github.com/diegosouzapw/OmniRoute" \
|
|
org.opencontainers.image.licenses="MIT"
|
|
|
|
ENV NODE_ENV=production
|
|
ENV PORT=20128
|
|
ENV HOSTNAME=0.0.0.0
|
|
ENV NODE_OPTIONS="--max-old-space-size=256"
|
|
|
|
# Data directory inside Docker — must match the volume mount in docker-compose.yml
|
|
ENV DATA_DIR=/app/data
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends libsecret-1-0 ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
RUN mkdir -p /app/data
|
|
|
|
COPY --from=builder /app/public ./public
|
|
COPY --from=builder /app/.next/static ./.next/static
|
|
COPY --from=builder /app/.next/standalone ./
|
|
# Explicitly copy @swc/helpers — not always traced by standalone output but needed at runtime
|
|
COPY --from=builder /app/node_modules/@swc/helpers ./node_modules/@swc/helpers
|
|
# Explicitly copy pino transport dependencies — pino spawns a worker that requires
|
|
# pino-abstract-transport at runtime; Next.js standalone trace does not capture it (#449)
|
|
COPY --from=builder /app/node_modules/pino-abstract-transport ./node_modules/pino-abstract-transport
|
|
COPY --from=builder /app/node_modules/pino-pretty ./node_modules/pino-pretty
|
|
COPY --from=builder /app/node_modules/split2 ./node_modules/split2
|
|
# Migration SQL files are read via fs.readFileSync at runtime and are NOT
|
|
# traced by Next.js standalone output — copy them explicitly.
|
|
COPY --from=builder /app/src/lib/db/migrations ./migrations
|
|
ENV OMNIROUTE_MIGRATIONS_DIR=/app/migrations
|
|
# MITM server.cjs is spawned at runtime via child_process — not traced by nft
|
|
COPY --from=builder /app/src/mitm/server.cjs ./src/mitm/server.cjs
|
|
# Documentation files and OpenAPI spec are read from disk at runtime.
|
|
# Next.js standalone tracing does not include them.
|
|
COPY --from=builder /app/docs ./docs
|
|
|
|
COPY --from=builder /app/scripts/dev/run-standalone.mjs ./dev/run-standalone.mjs
|
|
COPY --from=builder /app/scripts/build/runtime-env.mjs ./build/runtime-env.mjs
|
|
COPY --from=builder /app/scripts/build/bootstrap-env.mjs ./build/bootstrap-env.mjs
|
|
COPY --from=builder /app/scripts/dev/healthcheck.mjs ./healthcheck.mjs
|
|
|
|
# Hand /app over to the baked-in `node` non-root user (UID/GID 1000) so the
|
|
# runtime process never holds root privileges. The chown happens after all
|
|
# COPYs so it covers files originally owned by root in the builder stage.
|
|
RUN chown -R node:node /app
|
|
|
|
EXPOSE 20128
|
|
|
|
USER node
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
|
|
CMD ["node", "healthcheck.mjs"]
|
|
|
|
CMD ["node", "dev/run-standalone.mjs"]
|
|
|
|
FROM runner-base AS runner-cli
|
|
|
|
# Drop back to root briefly so we can install system + global npm packages,
|
|
# then return to the `node` non-root user before the CMD inherited from
|
|
# runner-base runs.
|
|
USER root
|
|
|
|
# Install system dependencies required by openclaw (git+ssh references).
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends git ca-certificates docker.io docker-compose \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& git config --system url."https://github.com/".insteadOf "ssh://git@github.com/"
|
|
|
|
# Install CLI tools globally. Separate layer from apt for better cache reuse.
|
|
RUN npm install -g --no-audit --no-fund @openai/codex @anthropic-ai/claude-code droid openclaw@latest
|
|
|
|
USER node
|
|
|