| 1 | # syntax=docker/dockerfile:1 |
| 2 | # DeepSeek-TUI multi-arch Docker image (#501) |
| 3 | # |
| 4 | # Build: docker buildx build --platform linux/amd64,linux/arm64 -t deepseek-tui:latest . |
| 5 | # Run: docker run --rm -it -e DEEPSEEK_API_KEY -v ~/.deepseek:/home/deepseek/.deepseek deepseek-tui |
| 6 | # |
| 7 | # The image ships both binaries (deepseek dispatcher + deepseek-tui runtime) |
| 8 | # in a minimal runtime layer. No MCP servers or heavy toolchains are included |
| 9 | # — keep it slim. |
| 10 | # |
| 11 | # API keys MUST be passed at runtime (never baked into the image): |
| 12 | # docker run --rm -it -e DEEPSEEK_API_KEY deepseek-tui |
| 13 | # Or mount an env file: |
| 14 | # docker run --rm -it --env-file .env deepseek-tui |
| 15 | |
| 16 | ARG RUST_VERSION=1.88 |
| 17 | |
| 18 | # ── Stage 1: Build ──────────────────────────────────────────────────── |
| 19 | FROM --platform=$BUILDPLATFORM rust:${RUST_VERSION}-slim-bookworm AS builder |
| 20 | ARG TARGETPLATFORM |
| 21 | ARG BUILDPLATFORM |
| 22 | |
| 23 | RUN apt-get update && apt-get install -y --no-install-recommends \ |
| 24 | pkg-config libdbus-1-dev \ |
| 25 | && rm -rf /var/lib/apt/lists/* |
| 26 | |
| 27 | # Translate Docker platform into Rust target triple. |
| 28 | # linux/amd64 → x86_64-unknown-linux-gnu |
| 29 | # linux/arm64 → aarch64-unknown-linux-gnu |
| 30 | RUN case "${TARGETPLATFORM}" in \ |
| 31 | linux/amd64) echo x86_64-unknown-linux-gnu > /rust-target ;; \ |
| 32 | linux/arm64) echo aarch64-unknown-linux-gnu > /rust-target ;; \ |
| 33 | *) echo "Unsupported platform: ${TARGETPLATFORM}" >&2; exit 1 ;; \ |
| 34 | esac |
| 35 | |
| 36 | RUN rustup target add "$(cat /rust-target)" |
| 37 | |
| 38 | WORKDIR /build |
| 39 | COPY . . |
| 40 | |
| 41 | # Build both binaries for the target platform. --locked ensures |
| 42 | # reproducible builds from the committed lockfile. |
| 43 | RUN --mount=type=cache,target=/build/target \ |
| 44 | --mount=type=cache,target=/usr/local/cargo/registry \ |
| 45 | cargo build --release --locked --target "$(cat /rust-target)" \ |
| 46 | && mkdir -p /out \ |
| 47 | && cp target/$(cat /rust-target)/release/deepseek /out/ \ |
| 48 | && cp target/$(cat /rust-target)/release/deepseek-tui /out/ |
| 49 | |
| 50 | # ── Stage 2: Runtime ────────────────────────────────────────────────── |
| 51 | FROM debian:bookworm-slim |
| 52 | |
| 53 | RUN apt-get update && apt-get install -y --no-install-recommends \ |
| 54 | ca-certificates \ |
| 55 | libdbus-1-3 \ |
| 56 | && rm -rf /var/lib/apt/lists/* |
| 57 | |
| 58 | # Non-root user with explicit UID/GID for filesystem ownership clarity. |
| 59 | RUN groupadd --gid 1000 deepseek \ |
| 60 | && useradd --create-home --shell /bin/bash --uid 1000 --gid 1000 deepseek |
| 61 | USER deepseek |
| 62 | WORKDIR /home/deepseek |
| 63 | |
| 64 | COPY --from=builder --chown=deepseek:deepseek /out/deepseek /usr/local/bin/deepseek |
| 65 | COPY --from=builder --chown=deepseek:deepseek /out/deepseek-tui /usr/local/bin/deepseek-tui |
| 66 | |
| 67 | # The dispatcher expects to find its companion binary next to it. |
| 68 | # Both are in /usr/local/bin — no further path setup needed. |
| 69 | |
| 70 | ENTRYPOINT ["deepseek"] |
| 71 | CMD [] |
| 72 |