Dockerfile

# syntax=docker/dockerfile:1.7

# ── Builder ──────────────────────────────────────────────────────────────
FROM rust:1-bookworm AS builder

WORKDIR /build

# aws-lc-rs (rustls backend) needs cmake + a C toolchain; build-essential is
# already present in the rust: image. libclang is only needed by some crates
# in the tree - install here rather than debugging a rebuild later.
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        cmake \
        libclang-dev \
    && rm -rf /var/lib/apt/lists/*

COPY . .

# Use the committed .sqlx/ offline cache so the build doesn't need a live DB.
ENV SQLX_OFFLINE=true

# sentio-mcp rides along so the release job can lift both binaries out of the
# image instead of running a second set of release builds.
RUN cargo build --release -p sentio-smtp -p sentio-mcp --bins \
    && strip target/release/sentio-smtp target/release/sentio-mcp

# ── Runtime ──────────────────────────────────────────────────────────────
FROM debian:bookworm-slim AS runtime

LABEL org.opencontainers.image.title="Sentio SMTP" \
      org.opencontainers.image.description="Email inbox API for AI agents: a multi-tenant mail server in Rust" \
      org.opencontainers.image.source="https://github.com/truespar/sentio" \
      org.opencontainers.image.licenses="MIT OR Apache-2.0"

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        ca-certificates \
        curl \
        libcap2-bin \
        tzdata \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd --system --gid 1000 sentio \
    && useradd  --system --uid 1000 --gid sentio \
                --home-dir /var/lib/sentio --shell /usr/sbin/nologin sentio \
    && mkdir -p /etc/sentio /var/lib/sentio \
    && chown -R sentio:sentio /etc/sentio /var/lib/sentio

COPY --from=builder /build/target/release/sentio-smtp /usr/local/bin/sentio-smtp
COPY --from=builder /build/target/release/sentio-mcp  /usr/local/bin/sentio-mcp
COPY --from=builder /build/migrations /usr/share/sentio/migrations
COPY config/oss.toml /etc/sentio/oss.toml
# Licence obligations travel with the binary, not just the repo.
COPY LICENSE LICENSE-MIT LICENSE-APACHE THIRD-PARTY-NOTICES.md \
     /usr/share/doc/sentio/

# Allow the non-root user to bind :25/465/587 without full root.
RUN setcap 'cap_net_bind_service=+ep' /usr/local/bin/sentio-smtp

USER sentio
WORKDIR /var/lib/sentio

EXPOSE 25 465 587 8080 9090

HEALTHCHECK --interval=10s --timeout=5s --start-period=30s --retries=6 \
    CMD curl -fsS http://localhost:8080/health/ready || exit 1

ENTRYPOINT ["/usr/local/bin/sentio-smtp"]
CMD ["--config", "/etc/sentio/oss.toml", "serve"]