From 6256e3460004f4f5befa94b58dc90cdcd8539f50 Mon Sep 17 00:00:00 2001
From: Almir Bolduan <almir.bsi@gmail.com>
Date: Wed, 29 Jul 2026 09:03:17 -0300
Subject: [PATCH] build(docker): add Dockerfile for building a server image

Multi-stage build: compiles aw-webui and aw-server, then ships only the
release binary on debian:bookworm-slim with libssl3.

Only aw-server is built, not aw-sync: on Linux the latter pulls in openssl
with the "vendored" feature and compiles OpenSSL from source, which is not
needed by the image.
---
 .dockerignore |  8 ++++++++
 Dockerfile    | 33 +++++++++++++++++++++++++++++++++
 README.md     | 35 +++++++++++++++++++++++++++++++++++
 3 files changed, 76 insertions(+)
 create mode 100644 .dockerignore
 create mode 100644 Dockerfile

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 00000000..871b07ba
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,8 @@
+target/
+dist/
+aw-webui/dist/
+aw-webui/node_modules/
+**/node_modules/
+.cov/
+coverage-html/
+.serena/
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 00000000..92b3801c
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,33 @@
+# Build stage: aw-webui (node) + aw-server (rust, with the webui embedded via rust-embed)
+FROM rust:1-bookworm AS builder
+
+RUN apt-get update -qq -y && \
+    apt-get install -qq -y --no-install-recommends \
+        build-essential pkg-config libssl-dev ca-certificates curl git make gnupg && \
+    curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \
+    apt-get install -qq -y --no-install-recommends nodejs && \
+    rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app/aw-server-rust
+COPY . .
+
+# `make aw-server` builds the webui (aw-webui/dist) before cargo, so that
+# aw-server's build.rs can embed the assets into the binary.
+# We avoid the `build` target, which also builds aw-sync: that binary pulls in
+# openssl with the "vendored" feature (builds OpenSSL from source) and is not
+# used by this image.
+RUN make aw-server
+
+FROM debian:bookworm-slim
+
+RUN apt-get update -qq -y && \
+    apt-get install -qq -y --no-install-recommends \
+        libssl3 && \
+    rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /app/aw-server-rust/target/release/aw-server /usr/local/bin/aw-server-rust
+COPY --from=builder /app/aw-server-rust/aw-webui/dist /usr/local/share/aw-webui
+
+EXPOSE 5600
+
+CMD ["aw-server-rust"]
diff --git a/README.md b/README.md
index 4766e574..4f5eeb26 100644
--- a/README.md
+++ b/README.md
@@ -42,6 +42,41 @@ cargo run --bin aw-server
 
 *NOTE:* This will start aw-server-rust in testing mode (on port 5666 instead of port 5600).
 
+### Docker
+
+A multi-stage `Dockerfile` is included. It builds the web UI and the server, and
+produces a slim Debian-based image containing only the `aw-server` binary (the
+web UI assets are embedded into it at compile time).
+
+The `aw-webui` submodule must be initialized before building:
+
+```sh
+git submodule update --init --recursive
+docker build -t aw-server-rust:local .
+```
+
+Run it with:
+
+```sh
+docker run -d --name aw-server-rust \
+    -p 5600:5600 \
+    -v aw-server-rust-data:/root/.local/share/activitywatch \
+    aw-server-rust:local aw-server-rust --host 0.0.0.0
+```
+
+Notes:
+
+ - The server binds to `127.0.0.1` by default, which is unreachable from outside
+   the container. Pass `--host 0.0.0.0` (as above) to make it reachable.
+ - The database lives in `/root/.local/share/activitywatch/aw-server-rust`.
+   Mount a volume there to keep it across container recreations.
+ - The image only ships `aw-server`. The `aw-sync` binary is deliberately not
+   built, since on Linux it pulls in OpenSSL with the `vendored` feature and
+   compiles it from source.
+ - `docker build` produces an image for the architecture of the machine running
+   it. To target a different one, use
+   `docker buildx build --platform linux/amd64 ...`.
+
 ### Configuration
 
 The server reads its configuration from `~/.config/activitywatch/aw-server-rust/config.toml` (or `config-testing.toml` in testing mode).