@dockerforge/core 0.1.3 → 0.2.0

package/README.md

@@ -22,6 +22,9 @@ npm install @dockerforge/core
 
 ## Generate
 
+The supported public API is exported from the package root. Internal files under `src/engine` are
+not part of the compatibility contract.
+
 ```js
 const core = require('@dockerforge/core');
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dockerforge/core",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "description": "DockerForge engine: analyse a local project and generate production-grade Dockerfiles, .dockerignore, and Compose, and lint Dockerfiles. Offline, no network.",
   "license": "Apache-2.0",
   "author": "Docker Forge",
@@ -14,6 +14,9 @@
     "url": "https://github.com/Mo-ASayed/DockerForge/issues"
   },
   "main": "src/index.js",
+  "exports": {
+    ".": "./src/index.js"
+  },
   "files": [
     "src",
     "LICENSE",
@@ -37,8 +40,8 @@
     "sarif"
   ],
   "dependencies": {
-    "adm-zip": "^0.5.10",
-    "fs-extra": "^11.2.0",
-    "glob": "^10.3.10"
+    "adm-zip": "^0.5.18",
+    "fs-extra": "^11.3.6",
+    "glob": "^13.0.6"
   }
 }

package/src/engine/analysis/analyser.js

@@ -4,12 +4,47 @@
 const path = require('path');
 const fs = require('fs-extra');
 const { STACKS, DEFAULT_VERSIONS, DEFAULT_PORTS, ROOT_CONFIG_FILES } = require('../constants');
+const { UnsupportedStackError } = require('../../errors');
+
+// Marker files for popular languages DockerForge does NOT generate for yet. Used only when no
+// supported stack was found, so we can name the language in the error instead of a generic
+// "nothing found". Keep this list ordered most-specific first.
+const UNSUPPORTED_LANGUAGE_MARKERS = [
+  { name: 'Ruby',            files: ['Gemfile', 'Gemfile.lock', 'config.ru', '.ruby-version'] },
+  { name: 'Java',            files: ['pom.xml', 'build.gradle', 'build.gradle.kts', 'settings.gradle', 'gradlew'] },
+  { name: 'PHP',             files: ['composer.json', 'composer.lock', 'artisan'] },
+  { name: 'Elixir',          files: ['mix.exs'] },
+  { name: 'Scala',           files: ['build.sbt'] },
+  { name: 'Swift',           files: ['Package.swift'] },
+  { name: 'Dart or Flutter', files: ['pubspec.yaml'] },
+  { name: 'Deno',            files: ['deno.json', 'deno.jsonc'] },
+];
+
+const SUPPORTED_STACKS_TEXT = 'Node.js, Python, .NET, Go, and Rust';
+
+// Project-controlled names (a Cargo crate name, a Go module path, a cmd/ dir) are interpolated
+// into shell-form RUN instructions in the generated Dockerfile. A crafted manifest could smuggle
+// shell metacharacters there and run arbitrary commands at `docker build` time. Restrict such
+// tokens to a safe charset; anything outside it falls back to a default so the output is always
+// a literal, single token. Valid Cargo/Go names already satisfy this, so real projects are
+// unaffected.
+const SAFE_NAME_RE = /^[A-Za-z0-9._-]+$/;
+function safeToken(value, fallback) {
+  return typeof value === 'string' && SAFE_NAME_RE.test(value) ? value : fallback;
+}
+// A Go build target is either "." or "./seg/seg" with safe segments only.
+function safeGoBuildTarget(target) {
+  if (target === '.') return true;
+  if (!target.startsWith('./')) return false;
+  return target.slice(2).split('/').every(seg => SAFE_NAME_RE.test(seg));
+}
 
 // ── Constants ────────────────────────────────────────────────────────────────
 
 // Dirs that are never service roots
 const SKIP_DIRS = new Set([
   'node_modules', '.git', '.next', '.nuxt', 'dist', 'build',
+  'target', 'vendor', // rust build output / go vendored deps
   '__pycache__', '.pytest_cache', 'bin', 'obj', 'coverage',
   '.venv', 'venv', 'env', '.env', '.idea', '.vscode',
   'public', 'static', 'assets', 'media', '.cache', 'out', '.output',
@@ -126,6 +161,8 @@ const LOCKFILE_MAP = {
   [STACKS.NODE]:   ['yarn.lock', 'package-lock.json', 'pnpm-lock.yaml'],
   [STACKS.PYTHON]: [],   // pip projects have no lockfile; poetry/pipenv detected via their own manifests
   [STACKS.DOTNET]: [],
+  [STACKS.GO]:     [],   // go.mod is the manifest; go.sum is optional for detection
+  [STACKS.RUST]:  [],    // Cargo.toml is the manifest; Cargo.lock optional for detection
 };
 
 function hasLockfile(fileNames, stack) {
@@ -133,6 +170,66 @@ function hasLockfile(fileNames, stack) {
   return required.length === 0 || required.some(lf => fileNames.includes(lf));
 }
 
+async function fileContainsGoMain(filePath) {
+  try {
+    const content = await fs.readFile(filePath, 'utf-8');
+    return /^\s*package\s+main\b/m.test(content);
+  } catch {
+    return false;
+  }
+}
+
+async function hasRunnableGoEntrypoint(dir, fileNames) {
+  for (const fileName of fileNames) {
+    if (fileName.endsWith('.go') && await fileContainsGoMain(path.join(dir, fileName))) {
+      return true;
+    }
+  }
+
+  try {
+    const cmdDir = path.join(dir, 'cmd');
+    const cmdEntries = await fs.readdir(cmdDir, { withFileTypes: true });
+    for (const entry of cmdEntries) {
+      if (!entry.isDirectory()) continue;
+      const entryDir = path.join(cmdDir, entry.name);
+      const entryFiles = await fs.readdir(entryDir, { withFileTypes: true });
+      for (const file of entryFiles) {
+        if (file.isFile() && file.name.endsWith('.go') && await fileContainsGoMain(path.join(entryDir, file.name))) {
+          return true;
+        }
+      }
+    }
+  } catch {
+    // No cmd/ tree, or unreadable; root-level package main check above is enough.
+  }
+
+  return false;
+}
+
+async function hasRunnableRustEntrypoint(dir, cargoText) {
+  if (await fs.pathExists(path.join(dir, 'src', 'main.rs'))) return true;
+
+  try {
+    const binDir = path.join(dir, 'src', 'bin');
+    const entries = await fs.readdir(binDir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (entry.isFile() && entry.name.endsWith('.rs')) return true;
+      if (entry.isDirectory() && await fs.pathExists(path.join(binDir, entry.name, 'main.rs'))) return true;
+    }
+  } catch {
+    // src/bin is optional.
+  }
+
+  const binSections = [...cargoText.matchAll(/\[\[bin\]\]([\s\S]*?)(?=\n\s*\[|$)/g)];
+  for (const section of binSections) {
+    const pathMatch = section[1].match(/^\s*path\s*=\s*"([^"]+)"/m);
+    if (!pathMatch) return true;
+    if (await fs.pathExists(path.join(dir, pathMatch[1]))) return true;
+  }
+
+  return false;
+}
+
 // Returns all service root dirs found in the tree, with their detected stack.
 // Depth capped at 6 so we don't crawl into infinite nesting.
 async function findServiceRoots(projectPath) {
@@ -199,6 +296,19 @@ async function findServiceRoots(projectPath) {
       roots.set(dir, STACKS.DOTNET);
     }
 
+    if (!roots.has(dir) && fileNames.includes('go.mod') && await hasRunnableGoEntrypoint(dir, fileNames)) {
+      roots.set(dir, STACKS.GO);
+    }
+
+    if (!roots.has(dir) && fileNames.includes('Cargo.toml')) {
+      let cargoText = '';
+      try { cargoText = await fs.readFile(path.join(dir, 'Cargo.toml'), 'utf-8'); }
+      catch { /* unreadable manifests are handled later by the analyser */ }
+      if (await hasRunnableRustEntrypoint(dir, cargoText)) {
+        roots.set(dir, STACKS.RUST);
+      }
+    }
+
     // Recurse
     for (const entry of entries) {
       if (entry.isDirectory() && !SKIP_DIRS.has(entry.name)) {
@@ -209,9 +319,10 @@ async function findServiceRoots(projectPath) {
 
   await walk(projectPath, 0);
 
-  // If subdirectory services were found, drop any root-level service.
+  // If subdirectory services were found, drop any root-level non-compiled service.
   // A package.json at project root is usually a Vercel/workspace config, not a runnable service.
-  if (roots.size > 1 && roots.has(projectPath)) {
+  // Go/Rust roots are only registered after proving they have an entrypoint, so keep them.
+  if (roots.size > 1 && roots.has(projectPath) && ![STACKS.GO, STACKS.RUST].includes(roots.get(projectPath))) {
     roots.delete(projectPath);
   }
 
@@ -333,6 +444,30 @@ async function findWorkspaceSharedConfigs(projectPath, workspacePackageDirs) {
   return result;
 }
 
+// Scans the project root and its immediate subdirectories for marker files of a known-but-
+// unsupported language. Returns the language name (e.g. "Ruby") or null. Shallow on purpose:
+// it only runs when no supported stack was found, just to make the error message specific.
+async function detectUnsupportedLanguage(projectPath) {
+  const seen = new Set();
+  const collect = async (dir) => {
+    try {
+      const entries = await fs.readdir(dir, { withFileTypes: true });
+      for (const e of entries) if (e.isFile()) seen.add(e.name);
+      return entries;
+    } catch { return []; }
+  };
+  const rootEntries = await collect(projectPath);
+  for (const e of rootEntries) {
+    if (e.isDirectory() && !SKIP_DIRS.has(e.name)) {
+      await collect(path.join(projectPath, e.name));
+    }
+  }
+  for (const { name, files } of UNSUPPORTED_LANGUAGE_MARKERS) {
+    if (files.some(f => seen.has(f))) return name;
+  }
+  return null;
+}
+
 // ── Main Entry ───────────────────────────────────────────────────────────────
 
 async function analyseProject(projectPath, hints = {}) {
@@ -346,9 +481,18 @@ async function analyseProject(projectPath, hints = {}) {
   });
 
   if (roots.length === 0) {
-    throw new Error(
-      'No supported stack found (Node.js, Python, .NET). ' +
-      'Check the URL points at a folder containing source code.'
+    const lang = await detectUnsupportedLanguage(projectPath);
+    if (lang) {
+      throw new UnsupportedStackError(
+        `Detected a ${lang} project, which DockerForge does not generate Dockerfiles for yet. ` +
+        `Supported stacks: ${SUPPORTED_STACKS_TEXT}. ` +
+        `Follow the project for new language support, or hand-write a Dockerfile for now.`
+      );
+    }
+    throw new UnsupportedStackError(
+      `No supported stack found. DockerForge supports ${SUPPORTED_STACKS_TEXT}. ` +
+      `Point it at a folder containing one of: package.json, requirements.txt / pyproject.toml / setup.py / Pipfile, ` +
+      `a .csproj file, go.mod, or Cargo.toml.`
     );
   }
 
@@ -382,6 +526,8 @@ async function analyseProject(projectPath, hints = {}) {
     if (resolvedStack === STACKS.NODE)   analysis = await analyseNode(dir, files, hints, projectPath, isWorkspace);
     else if (resolvedStack === STACKS.PYTHON) analysis = await analysePython(dir, files, hints);
     else if (resolvedStack === STACKS.DOTNET) analysis = await analyseDotnet(dir, files, hints);
+    else if (resolvedStack === STACKS.GO)     analysis = await analyseGo(dir, files, hints);
+    else if (resolvedStack === STACKS.RUST)   analysis = await analyseRust(dir, files, hints);
     else continue;
 
     // Attach location info relative to project root
@@ -526,6 +672,7 @@ async function analyseNode(projectPath, files, hints, projectRootPath = null, is
   // Build output directory — detect framework-specific output paths
   let buildOutputDir = 'dist';
   let framework = null;
+  let nextStandalone = false; // true when Next.js is configured with output: 'standalone'
   // Root-level dirs referenced by vite config via '../dirname' imports.
   // Must be copied into build context before `vite build` runs.
   const rootBuildDeps = [];
@@ -620,14 +767,20 @@ async function analyseNode(projectPath, files, hints, projectRootPath = null, is
       }
     }
   } else if (framework === 'nextjs') {
-    try {
-      const configPath = path.join(serviceDir, 'next.config.js');
-      if (await fs.pathExists(configPath)) {
+    // Read whichever next.config.* exists (js/mjs/cjs/ts) for distDir and the standalone flag.
+    for (const configFile of ['next.config.js', 'next.config.mjs', 'next.config.cjs', 'next.config.ts']) {
+      try {
+        const configPath = path.join(serviceDir, configFile);
+        if (!(await fs.pathExists(configPath))) continue;
         const content = await fs.readFile(configPath, 'utf-8');
         const match = content.match(/distDir\s*:\s*['"]([^'"]+)['"]/);
         if (match && match[1]) buildOutputDir = match[1];
-      }
-    } catch { /* skip on error */ }
+        // `output: 'standalone'` makes `next build` emit a self-contained server bundle
+        // (.next/standalone with its own minimal node_modules + server.js).
+        if (/output\s*:\s*['"]standalone['"]/.test(content)) nextStandalone = true;
+        break;
+      } catch { /* skip on error */ }
+    }
   } else if (framework === 'astro') {
     const astroConfigNames = ['astro.config.mjs', 'astro.config.js', 'astro.config.ts'];
     for (const configFile of astroConfigNames) {
@@ -719,10 +872,26 @@ async function analyseNode(projectPath, files, hints, projectRootPath = null, is
     catch { /* absent */ }
   }
 
+  const SOURCE_FILE_CANDIDATES = [
+    entryPoint,
+    'index.html',
+    'server.js', 'server.mjs', 'server.cjs', 'server.ts',
+    'index.js', 'index.mjs', 'index.cjs', 'index.ts',
+    'main.js', 'main.mjs', 'main.cjs', 'main.ts',
+    'app.js', 'app.mjs', 'app.cjs', 'app.ts',
+  ].filter(Boolean);
+  const sourceFiles = [];
+  for (const f of [...new Set(SOURCE_FILE_CANDIDATES)]) {
+    try { if ((await fs.stat(path.join(projectPath, f))).isFile()) sourceFiles.push(f); }
+    catch { /* absent */ }
+  }
+
   // Detect framework build/runtime config files that exist, so we copy real filenames
   // instead of guessing a single hard-coded one. Next.js also reads its config at runtime.
   const FRAMEWORK_CONFIG_CANDIDATES = [
     'next.config.js', 'next.config.mjs', 'next.config.cjs', 'next.config.ts',
+    'vite.config.js', 'vite.config.mjs', 'vite.config.cjs', 'vite.config.ts', 'vite.config.mts',
+    'astro.config.js', 'astro.config.mjs', 'astro.config.cjs', 'astro.config.ts',
     'tailwind.config.js', 'tailwind.config.ts', 'tailwind.config.cjs', 'tailwind.config.mjs',
     'components.json', 'jsconfig.json',
     'remix.config.js', 'svelte.config.js', 'nuxt.config.ts', 'nuxt.config.js',
@@ -762,8 +931,10 @@ async function analyseNode(projectPath, files, hints, projectRootPath = null, is
     hasScopedPackages,
     siblingDeps,     // root-level dirs referenced via require('../xxx') — must be COPYed into runtime image
     sourceDirs,           // conventional source dirs that actually exist on disk (real, not guessed)
+    sourceFiles,          // top-level source/entry files that actually exist on disk
     frameworkConfigFiles, // framework build/runtime config files present (next.config, tailwind.config, ...)
     nextRuntimeConfig,    // the next.config.* file Next.js reads at runtime, or null
+    nextStandalone,       // true when next.config sets output: 'standalone' (self-contained server bundle)
     assumptions,
   };
 }
@@ -831,6 +1002,29 @@ async function findDjangoDirs(projectPath, files) {
   return [...dirs].sort();
 }
 
+// Top-level Python packages/modules to COPY for non-Django apps (FastAPI/Flask/plain).
+// Returns { dirs, rootModules }: directories at the project root that contain .py files,
+// and standalone .py files that live at the project root. This lets the generator copy the
+// real source tree (e.g. `app/`) instead of guessing a single root entry file — which breaks
+// the very common package layout (app/main.py with `uvicorn app.main:app`).
+function findPythonSourceDirs(projectPath, files) {
+  const dirs = new Set();
+  const rootModules = new Set();
+  for (const filePath of files) {
+    if (!filePath.endsWith('.py')) continue;
+    const rel = path.relative(projectPath, filePath).replace(/\\/g, '/');
+    const parts = rel.split('/');
+    if (parts.length === 1) {
+      // Root-level module. manage.py is handled by the Django path, never as a generic module.
+      if (parts[0] !== 'manage.py') rootModules.add(parts[0]);
+    } else {
+      const topDir = parts[0];
+      if (topDir && !topDir.startsWith('.') && !SKIP_DIRS.has(topDir)) dirs.add(topDir);
+    }
+  }
+  return { dirs: [...dirs].sort(), rootModules: [...rootModules].sort() };
+}
+
 async function findDotnetSourceDirs(projectPath) {
   const common = [
     'Controllers', 'Services', 'Models', 'Pages', 'Views', 'Repositories',
@@ -981,6 +1175,7 @@ async function analysePython(projectPath, files, hints) {
   const requirementsHasHashes = detectRequirementsHashes(dependencyText);
   let framework = await detectPythonFramework(projectPath, files, dependencyText);
   const djangoAppDirs = framework === 'django' ? await findDjangoDirs(projectPath, files) : [];
+  const pythonSource = findPythonSourceDirs(projectPath, files);
   let entryPoint = hints.entryPoint;
 
   if (!entryPoint) {
@@ -1043,6 +1238,8 @@ async function analysePython(projectPath, files, hints) {
     nativeDeps,
     requirementsHasHashes,
     djangoAppDirs,
+    pythonSourceDirs: pythonSource.dirs,
+    pythonRootModules: pythonSource.rootModules,
     port,
     hasBuild: hasNativeDeps,
     assumptions,
@@ -1090,6 +1287,143 @@ async function analyseDotnet(projectPath, files, hints) {
   };
 }
 
+// ── Go Analysis ──────────────────────────────────────────────────────────────
+
+async function analyseGo(projectPath, files, hints) {
+  const assumptions = [];
+  let goMod = '';
+  try { goMod = await fs.readFile(path.join(projectPath, 'go.mod'), 'utf-8'); }
+  catch { assumptions.push('Could not read go.mod, using defaults'); }
+
+  // Go toolchain version from the `go 1.xx` directive.
+  let version = hints.runtimeVersion;
+  if (!version) {
+    const m = goMod.match(/^\s*go\s+(\d+\.\d+)/m);
+    version = m ? m[1] : DEFAULT_VERSIONS[STACKS.GO];
+    if (!m) assumptions.push(`Go version not found in go.mod, defaulted to ${version}`);
+  }
+
+  // Module path → default binary name from its last path segment.
+  const moduleMatch = goMod.match(/^\s*module\s+(\S+)/m);
+  const modulePath = moduleMatch ? moduleMatch[1] : null;
+  const rawBinaryName = (modulePath ? modulePath.split('/').pop() : null) || 'app';
+  const binaryName = safeToken(rawBinaryName, 'app');
+  if (binaryName !== rawBinaryName) {
+    assumptions.push(`Module name "${rawBinaryName}" contains unsafe characters; using binary name "app" — set it explicitly.`);
+  }
+
+  // Locate the main package to build. Conventions: ./main.go at root, or ./cmd/<name>/.
+  const topLevel = files.filter(f => path.dirname(f) === projectPath).map(f => path.basename(f));
+  let buildTarget = '.';
+  if (!topLevel.includes('main.go')) {
+    const cmdDirs = new Set();
+    for (const f of files) {
+      const rel = path.relative(projectPath, f).replace(/\\/g, '/');
+      const parts = rel.split('/');
+      if (parts[0] === 'cmd' && parts.length >= 3 && parts[parts.length - 1].endsWith('.go')) {
+        cmdDirs.add(`./cmd/${parts[1]}`);
+      }
+    }
+    const cmds = [...cmdDirs];
+    if (cmds.length === 1) {
+      buildTarget = cmds[0];
+    } else if (cmds.length > 1) {
+      buildTarget = cmds[0];
+      assumptions.push(`Multiple cmd/ entrypoints found (${cmds.join(', ')}); building ${cmds[0]} — pass a hint to choose another`);
+    } else {
+      assumptions.push('No main.go at root or under cmd/ — defaulted build target to "." ; update it if your main package is elsewhere');
+    }
+  }
+
+  // Explicit source copies (we never emit `COPY . .`): top-level dirs that contain .go files,
+  // plus whether there are .go files at the repo root.
+  const goSourceDirs = new Set();
+  let hasRootGoFiles = false;
+  for (const f of files) {
+    if (!f.endsWith('.go')) continue;
+    const rel = path.relative(projectPath, f).replace(/\\/g, '/');
+    const parts = rel.split('/');
+    if (parts.length === 1) hasRootGoFiles = true;
+    else if (!SKIP_DIRS.has(parts[0])) goSourceDirs.add(parts[0]);
+  }
+
+  // Guard the build target too — it lands in `go build ... <target>`.
+  if (!safeGoBuildTarget(buildTarget)) {
+    assumptions.push(`Build target "${buildTarget}" contains unsafe characters; defaulted to "." — set it explicitly.`);
+    buildTarget = '.';
+  }
+
+  const port = hints.port || DEFAULT_PORTS[STACKS.GO];
+  if (!hints.port) assumptions.push(`Port not detected, defaulted to ${port}`);
+
+  return {
+    stack: STACKS.GO,
+    role: 'backend',
+    version,
+    modulePath,
+    binaryName,
+    buildTarget,
+    hasGoSum: files.some(f => path.basename(f) === 'go.sum'),
+    goSourceDirs: [...goSourceDirs].sort(),
+    hasRootGoFiles,
+    cgo: false,
+    port,
+    hasBuild: true,
+    assumptions,
+  };
+}
+
+// ── Rust Analysis ────────────────────────────────────────────────────────────
+
+async function analyseRust(projectPath, files, hints) {
+  const assumptions = [];
+  let cargo = '';
+  try { cargo = await fs.readFile(path.join(projectPath, 'Cargo.toml'), 'utf-8'); }
+  catch { assumptions.push('Could not read Cargo.toml, using defaults'); }
+
+  // Binary name: an explicit [[bin]] name wins, else the [package] name.
+  let binaryName = null;
+  const binMatch = cargo.match(/\[\[bin\]\][\s\S]*?name\s*=\s*"([^"]+)"/);
+  if (binMatch) binaryName = binMatch[1];
+  if (!binaryName) {
+    const pkgMatch = cargo.match(/\[package\][\s\S]*?name\s*=\s*"([^"]+)"/);
+    binaryName = pkgMatch ? pkgMatch[1] : null;
+  }
+  if (!binaryName) { binaryName = 'app'; assumptions.push('Crate name not found in Cargo.toml, defaulted binary to "app"'); }
+  const rawBinaryName = binaryName;
+  binaryName = safeToken(binaryName, 'app');
+  if (binaryName !== rawBinaryName) {
+    assumptions.push(`Crate name "${rawBinaryName}" contains unsafe characters; using binary name "app" — set it explicitly.`);
+  }
+
+  // Rust toolchain: rust-version in Cargo.toml if present, else default.
+  let version = hints.runtimeVersion;
+  if (!version) {
+    const rv = cargo.match(/rust-version\s*=\s*"([0-9.]+)"/);
+    version = rv ? rv[1] : DEFAULT_VERSIONS[STACKS.RUST];
+    if (!rv) assumptions.push(`rust-version not set in Cargo.toml, defaulted toolchain to ${version}`);
+  }
+
+  const hasLock = files.some(f => path.basename(f) === 'Cargo.lock');
+  if (!hasLock) assumptions.push('No Cargo.lock committed — builds are not fully reproducible; run `cargo generate-lockfile` and commit it');
+  const hasBuildRs = files.some(f => path.basename(f) === 'build.rs');
+
+  const port = hints.port || DEFAULT_PORTS[STACKS.RUST];
+  if (!hints.port) assumptions.push(`Port not detected, defaulted to ${port}`);
+
+  return {
+    stack: STACKS.RUST,
+    role: 'backend',
+    version,
+    binaryName,
+    hasLock,
+    hasBuildRs,
+    port,
+    hasBuild: true,
+    assumptions,
+  };
+}
+
 // ── File List Helper ─────────────────────────────────────────────────────────
 
 const { globSync } = require('glob');
@@ -1149,6 +1483,7 @@ function getFileList(projectPath) {
     absolute: true,
     ignore: [
       '**/node_modules/**', '**/.git/**', '**/bin/**', '**/obj/**',
+      '**/target/**', '**/vendor/**',
       '**/__tests__/**', '**/__mocks__/**', '**/test/**', '**/tests/**',
       '**/fixtures/**', '**/spec/**', '**/specs/**',
       '**/examples/**', '**/example/**', '**/samples/**', '**/sample/**',

package/src/engine/constants.js

@@ -5,12 +5,16 @@ const STACKS = {
   NODE: 'node',
   PYTHON: 'python',
   DOTNET: 'dotnet',
+  GO: 'go',
+  RUST: 'rust',
 };
 
 const DETECTION_FILES = {
   [STACKS.NODE]: ['package.json'],
   [STACKS.PYTHON]: ['requirements.txt', 'pyproject.toml', 'setup.py', 'Pipfile'],
   [STACKS.DOTNET]: ['.csproj'], // matched by extension
+  [STACKS.GO]: ['go.mod'],
+  [STACKS.RUST]: ['Cargo.toml'],
 };
 
 const BASE_IMAGES = {
@@ -20,18 +24,32 @@ const BASE_IMAGES = {
     runtime: (version) => `mcr.microsoft.com/dotnet/aspnet:${version}`,
     sdk: (version) => `mcr.microsoft.com/dotnet/sdk:${version}`,
   },
+  // Go and Rust compile to a static-ish binary; build on the toolchain image,
+  // ship on a tiny runtime. Go uses alpine; Rust links against glibc so uses debian-slim.
+  [STACKS.GO]: {
+    build: (version) => `golang:${version}-alpine3.21`,
+    runtime: () => `alpine:3.21`,
+  },
+  [STACKS.RUST]: {
+    build: (version) => `rust:${version}-slim-bookworm`,
+    runtime: () => `debian:bookworm-slim`,
+  },
 };
 
 const DEFAULT_VERSIONS = {
   [STACKS.NODE]: '20',
   [STACKS.PYTHON]: '3.12',
   [STACKS.DOTNET]: '8.0',
+  [STACKS.GO]: '1.23',
+  [STACKS.RUST]: '1.83',
 };
 
 const DEFAULT_PORTS = {
   [STACKS.NODE]: 3000,
   [STACKS.PYTHON]: 8000,
   [STACKS.DOTNET]: 8080,
+  [STACKS.GO]: 8080,
+  [STACKS.RUST]: 8080,
 };
 
 const IGNORED_DIRS = [

package/src/engine/explanation/explainer.js

@@ -8,6 +8,8 @@ function buildExplanation(analysis, result, securityNotes) {
     [STACKS.NODE]: 'Node.js',
     [STACKS.PYTHON]: 'Python',
     [STACKS.DOTNET]: '.NET',
+    [STACKS.GO]: 'Go',
+    [STACKS.RUST]: 'Rust',
   };
 
   const lines = [];
@@ -51,6 +53,20 @@ function buildExplanation(analysis, result, securityNotes) {
     lines.push(`**Multi-stage build:** Always used for .NET. The SDK is never shipped to production.`);
   }
 
+  if (analysis.stack === STACKS.GO) {
+    lines.push(
+      `**Base images:** build on \`golang:${analysis.version}-alpine\`, ship the compiled binary on \`alpine\`. CGO is disabled so the binary is static — the final image carries no Go toolchain.`
+    );
+    lines.push(`**Build strategy:** Multi-stage. Only the built binary reaches the runtime image.`);
+  }
+
+  if (analysis.stack === STACKS.RUST) {
+    lines.push(
+      `**Base images:** build on \`rust:${analysis.version}-slim-bookworm\`, ship the release binary on \`debian:bookworm-slim\` (Rust links glibc by default).`
+    );
+    lines.push(`**Build strategy:** Multi-stage. Only the release binary reaches the runtime image.`);
+  }
+
   // Port
   lines.push(`**Port:** \`${analysis.port}\` exposed`);
 

package/src/engine/generation/generator.js

@@ -151,25 +151,42 @@ function nodePruneLine(packageManager, cwd = '') {
   return `RUN ${prefix}npm prune --omit=dev`;
 }
 
-function nodeSourceCopyBlock(a, configCopyLine = '', frontendAssetCopyLine = '') {
+function detectedNodeSourceCopyBlock(a) {
+  const lines = [];
+  const sourceFiles = Array.isArray(a.sourceFiles) ? a.sourceFiles : [];
+  const sourceDirs = Array.isArray(a.sourceDirs) ? a.sourceDirs : [];
+  const dirSet = new Set(sourceDirs);
+
+  // Skip a source file that already lives inside a copied source dir — otherwise we emit a
+  // redundant (and mis-located) `COPY src/server.js ./` alongside `COPY src/ ./src/`, which
+  // drops the entry file at /app/server.js where nothing reads it.
+  for (const f of sourceFiles) {
+    const top = f.split('/')[0];
+    if (f.includes('/') && dirSet.has(top)) continue;
+    lines.push(`COPY ${f} ./`);
+  }
+  for (const d of sourceDirs) lines.push(`COPY ${d}/ ./${d}/`);
+
+  if (lines.length === 0) {
+    lines.push('# No conventional source files were detected; add COPY lines for your application code.');
+  }
+
+  return lines.join('\n');
+}
+
+function nodeSourceCopyBlock(a, configCopyLine = '') {
   const blocks = [];
   if (configCopyLine) blocks.push(configCopyLine.trimEnd());
   if (a.framework === 'nextjs') {
-    blocks.push('COPY app/ ./app/');
-    blocks.push('COPY pages/ ./pages/');
-    blocks.push('COPY components/ ./components/');
-    blocks.push('COPY public/ ./public/');
+    blocks.push(detectedNodeSourceCopyBlock(a));
   } else if (a.framework === 'remix') {
-    blocks.push('COPY app/ ./app/');
-    blocks.push('COPY public/ ./public/');
+    blocks.push(detectedNodeSourceCopyBlock(a));
   } else if (['astro', 'vite', 'cra', 'sveltekit'].includes(a.framework)) {
-    if (frontendAssetCopyLine) blocks.push(frontendAssetCopyLine.trimEnd());
-    blocks.push('COPY src/ ./src/');
+    blocks.push(detectedNodeSourceCopyBlock(a));
   } else if (a.framework === 'nestjs') {
-    blocks.push('COPY src/ ./src/');
+    blocks.push(detectedNodeSourceCopyBlock(a));
   } else {
-    blocks.push('# Update these COPY lines if your source is not under src/.');
-    blocks.push('COPY src/ ./src/');
+    blocks.push(detectedNodeSourceCopyBlock(a));
   }
   return blocks.join('\n');
 }
@@ -348,6 +365,8 @@ function generateSingleRoot(a, envVars = [], rootConfigFiles = []) {
   if (a.stack === STACKS.NODE)   return generateNodeRoot(a, envVars, rootConfigFiles);
   if (a.stack === STACKS.PYTHON) return generatePythonRoot(a, rootConfigFiles);
   if (a.stack === STACKS.DOTNET) return generateDotnetRoot(a);
+  if (a.stack === STACKS.GO)     return generateGoRoot(a, '.');
+  if (a.stack === STACKS.RUST)   return generateRustRoot(a, '.');
   throw new Error(`No template for stack: ${a.stack}`);
 }
 
@@ -359,6 +378,8 @@ function generateSingleSub(a, sharedDirs, staticAssets, rootConfigFiles = [], en
   if (a.stack === STACKS.NODE)   return generateNodeSub(a, dir, sharedDirs, staticAssets, rootConfigFiles, envVars, workspacePackageDirs, workspaceSharedConfigs);
   if (a.stack === STACKS.PYTHON) return generatePythonSub(a, dir, sharedDirs, staticAssets);
   if (a.stack === STACKS.DOTNET) return generateDotnetSub(a, dir, sharedDirs);
+  if (a.stack === STACKS.GO)     return generateGoRoot(a, dir);
+  if (a.stack === STACKS.RUST)   return generateRustRoot(a, dir);
   throw new Error(`No template for stack: ${a.stack}`);
 }
 
@@ -681,9 +702,11 @@ function generateNodeRoot(a, envVars = [], rootConfigFiles = []) {
   const baseImage = BASE_IMAGES[STACKS.NODE](a.version);
   const improvements = [];
   const startCmdJson = JSON.stringify(runtimeStartCmd(a));
-  const extraConfigs = rootConfigFiles.filter(f => !['package.json', a.lockFile].includes(f));
+  const extraConfigs = [...new Set([
+    ...rootConfigFiles,
+    ...(a.frameworkConfigFiles || []),
+  ])].filter(f => !['package.json', a.lockFile].includes(f));
   const configCopyLine = extraConfigs.length > 0 ? `COPY ${extraConfigs.join(' ')} ./\n` : '';
-  const frontendAssetCopyLine = (a.role === 'frontend' || a.framework === 'cra') ? 'COPY public/ ./public/\n' : '';
 
   let dockerfile;
 
@@ -691,7 +714,7 @@ function generateNodeRoot(a, envVars = [], rootConfigFiles = []) {
     const buildInstall = nodeInstallLine(a.packageManager, false, { hasScopedPackages: a.hasScopedPackages });
     const buildPrefix = buildCommandPrefix(a);
     const buildOut = a.buildOutputDir || 'dist';
-    const sourceCopyBlock = nodeSourceCopyBlock(a, configCopyLine, frontendAssetCopyLine);
+    const sourceCopyBlock = nodeSourceCopyBlock(a, configCopyLine);
 
     // Next.js (and other SSR frameworks): a Node server, NOT a static site.
     // Build with `next build`, then run `next start` on a lean Node runtime. Serving the
@@ -699,6 +722,57 @@ function generateNodeRoot(a, envVars = [], rootConfigFiles = []) {
     if (a.framework === 'nextjs') {
       const nextSrcCopy = nextSourceCopyBlock(a, rootConfigFiles);
       const hasPublic = Array.isArray(a.sourceDirs) && a.sourceDirs.includes('public');
+
+      // ── output: 'standalone' — smallest, self-contained server bundle ──
+      // `next build` emits .next/standalone (server.js + its own minimal node_modules) plus
+      // .next/static. The runtime copies just those — no install, no full node_modules.
+      if (a.nextStandalone) {
+        const publicCopyStandalone = hasPublic
+          ? `COPY --from=builder --chown=node:node /app/public ./public\n` : '';
+        dockerfile = `
+# ─── Stage 1: Build ───────────────────────────────────────
+${builderFrom(baseImage, 'builder')}
+
+WORKDIR /app
+
+ENV NEXT_TELEMETRY_DISABLED=1
+
+COPY ${a.lockFile} package.json ./
+${buildInstall}
+
+# Copy source and build-time config
+${nextSrcCopy}
+RUN ${buildPrefix}${a.buildCommand}
+
+# ─── Stage 2: Runtime ─────────────────────────────────────
+FROM ${baseImage}
+
+WORKDIR /app
+
+${buildEnvBlock(envVars)}
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV PORT=${a.port}
+ENV HOSTNAME=0.0.0.0
+
+# Self-contained server bundle from output: 'standalone' — no node_modules install needed
+${publicCopyStandalone}COPY --from=builder --chown=node:node /app/${buildOut}/standalone ./
+COPY --from=builder --chown=node:node /app/${buildOut}/static ./${buildOut}/static
+
+USER node
+
+${nodeStopSignalBlock()}
+EXPOSE ${a.port}
+${simpleHttpHealthcheck(a.port)}
+CMD ["node", "server.js"]`.trim();
+
+        improvements.push('Next.js standalone build detected (output: "standalone"): shipped as a self-contained server bundle (.next/standalone) — no node_modules in the runtime image, smallest output.');
+        if (a.hasScopedPackages) {
+          improvements.push('Scoped packages detected (may include a private registry): the build install keeps a secret mount — build with `docker build --secret id=npmrc,src=.npmrc .` and a .npmrc that authenticates your scope.');
+        }
+        improvements.push('HEALTHCHECK probes /health, which Next.js does not expose by default — add a health route or point the healthcheck at an existing path.');
+        return { dockerfile, dockerignore: nodeDockerignore(), improvements };
+      }
+
       const publicCopy = hasPublic ? `COPY --from=builder /app/public ./public\n` : '';
       const runtimeConfigCopy = a.nextRuntimeConfig
         ? `COPY --from=builder /app/${a.nextRuntimeConfig} ./${a.nextRuntimeConfig}\n`
@@ -751,7 +825,7 @@ ${simpleHttpHealthcheck(a.port)}
 CMD ${startCmdJson}`.trim();
 
       improvements.push('Next.js is built and run as a Node server (next start) so SSR and API routes work — a generic static server image would break them.');
-      improvements.push('Production node_modules are copied from the build stage (deps fetched once). For an even smaller image, set `output: "standalone"` in next.config and copy .next/standalone + .next/static.');
+      improvements.push('Production node_modules are copied from the build stage (deps fetched once). For an even smaller image, set `output: "standalone"` in next.config — DockerForge will then emit the self-contained standalone bundle automatically.');
       improvements.push('Only known framework config files are auto-copied — verify any project-specific build config is also COPYed (e.g. sentry.*.config.ts, next-i18next.config).');
       if (a.hasScopedPackages) {
         improvements.push('Scoped packages detected (may include a private registry): the install keeps a secret mount — build with `docker build --secret id=npmrc,src=.npmrc .` and a .npmrc that authenticates your scope.');
@@ -845,14 +919,12 @@ CMD ${startCmdJson}`.trim();
 
   improvements.push('HEALTHCHECK probes /health; add a /health endpoint returning 2xx if your app does not already expose one');
   if (!a.hasBuild) improvements.push('If you add a build step later, use multi-stage builds to keep image small');
-  if (a.framework === null) {
-    improvements.push('WARNING: Unknown Node backend source layout - verify your source is not under src/ before using the generated COPY src/ line.');
+  if ((a.sourceDirs || []).length === 0 && (a.sourceFiles || []).length === 0) {
+    improvements.push('WARNING: No conventional Node source files or directories were detected; add explicit COPY lines for your application code before building.');
   }
   if (a.hasScopedPackages) {
     improvements.push('Scoped packages detected: pass private registry credentials with docker build --secret id=npmrc,src=.npmrc');
   }
-  improvements.push('Verify your source lives in src/ — if not, update the COPY src/ line in the build stage to match your actual source directory.');
-
   improvements.push('Add a SIGTERM handler: process.on(\'SIGTERM\', () => server.close())');
 
   return { dockerfile, dockerignore: nodeDockerignore(), improvements };
@@ -1106,10 +1178,19 @@ function generatePythonRoot(a, rootConfigFiles = []) {
 
   // Explicit source copy — COPY . . is banned.
   // Django: manage.py lives at root; user must add app dirs themselves.
-  // FastAPI/Flask: copy the detected entry point.
+  // FastAPI/Flask/plain: copy the real top-level packages and root modules detected by the
+  // analyser. Copying just the entry file breaks the standard package layout (e.g. app/main.py
+  // started as `uvicorn app.main:app`) — the `app/` package must be present in the image.
+  const pythonSrcLines = [
+    ...(a.pythonRootModules || []).map(m => `COPY ${m} ./`),
+    ...(a.pythonSourceDirs || []).map(d => `COPY ${d}/ ./${d}/`),
+  ];
+  const nonDjangoSourceCopy = pythonSrcLines.length > 0
+    ? pythonSrcLines.join('\n')
+    : `COPY ${a.entryPoint} ./`;
   const sourceCopyBlock = a.framework === 'django'
     ? `COPY manage.py ./\n# TODO: add your Django app directories below, e.g.:\n# COPY myapp/ ./myapp/`
-    : `COPY ${a.entryPoint} ./`;
+    : nonDjangoSourceCopy;
 
   const detectedDjangoCopyBlock = a.framework === 'django' && (a.djangoAppDirs || []).length > 0
     ? `COPY manage.py ./\n${a.djangoAppDirs.map(d => `COPY ${d}/ ./${d}/`).join('\n')}`
@@ -1310,6 +1391,112 @@ ENTRYPOINT ["dotnet", "${a.projectName}.dll"]`.trim();
   return { dockerfile, dockerignore: dotnetDockerignore(), improvements: [] };
 }
 
+// ── Go ───────────────────────────────────────────────────────────────────────
+// Compile a static binary on the toolchain image, ship it on a tiny alpine runtime.
+// Works for a module at the repo root (dir='.') or in a subdirectory.
+
+function generateGoRoot(a, dir = '.') {
+  const buildImage = BASE_IMAGES[STACKS.GO].build(a.version);
+  const runtimeImage = BASE_IMAGES[STACKS.GO].runtime();
+  const p = dir === '.' ? '' : `${dir}/`;
+  const bin = a.binaryName || 'app';
+  const target = a.buildTarget || '.';
+
+  const modCopy = a.hasGoSum ? `COPY ${p}go.mod ${p}go.sum ./` : `COPY ${p}go.mod ./`;
+  const srcCopies = [];
+  if (a.hasRootGoFiles) srcCopies.push(`COPY ${p}*.go ./`);
+  for (const d of (a.goSourceDirs || [])) srcCopies.push(`COPY ${p}${d}/ ./${d}/`);
+  if (srcCopies.length === 0) srcCopies.push(`COPY ${p}*.go ./`);
+
+  const dockerfile = `
+# ─── Stage 1: Build ───────────────────────────────────────
+FROM ${buildImage} AS build
+WORKDIR /src
+
+${modCopy}
+RUN --mount=type=cache,target=/go/pkg/mod \\
+    go mod download
+
+${srcCopies.join('\n')}
+RUN --mount=type=cache,target=/go/pkg/mod \\
+    --mount=type=cache,target=/root/.cache/go-build \\
+    CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/${bin} ${target}
+
+# ─── Stage 2: Runtime ─────────────────────────────────────
+FROM ${runtimeImage}
+WORKDIR /app
+
+RUN apk add --no-cache ca-certificates && \\
+    addgroup -S appgroup && adduser -S appuser -G appgroup
+
+COPY --from=build /out/${bin} /usr/local/bin/${bin}
+
+USER appuser
+EXPOSE ${a.port}
+ENTRYPOINT ["/usr/local/bin/${bin}"]`.trim();
+
+  const improvements = [
+    `Go binary built static (CGO disabled) and shipped on ${runtimeImage} — tiny, no toolchain in the final image.`,
+    `Build target is \`${target}\` and the binary is \`${bin}\` (from the module path). Verify these match your main package.`,
+    `EXPOSE ${a.port} is a default — set the real port (or pass a hint) if your service listens elsewhere.`,
+    'No HEALTHCHECK is emitted (Go apps have no standard health route) — add one pointing at your readiness endpoint.',
+  ];
+  return { dockerfile, dockerignore: goDockerignore(), improvements };
+}
+
+// ── Rust ───────────────────────────────────────────────────────────────────────
+// Build the release binary on the toolchain image, ship it on debian-slim
+// (Rust links glibc by default, so a glibc runtime is the safe choice).
+
+function generateRustRoot(a, dir = '.') {
+  const buildImage = BASE_IMAGES[STACKS.RUST].build(a.version);
+  const runtimeImage = BASE_IMAGES[STACKS.RUST].runtime();
+  const p = dir === '.' ? '' : `${dir}/`;
+  const bin = a.binaryName || 'app';
+  const lockedFlag = a.hasLock ? ' --locked' : '';
+
+  const manifestCopy = a.hasLock
+    ? `COPY ${p}Cargo.toml ${p}Cargo.lock ./`
+    : `COPY ${p}Cargo.toml ./`;
+  const buildRsCopy = a.hasBuildRs ? `COPY ${p}build.rs ./\n` : '';
+
+  const dockerfile = `
+# ─── Stage 1: Build ───────────────────────────────────────
+FROM ${buildImage} AS build
+WORKDIR /app
+
+${manifestCopy}
+${buildRsCopy}COPY ${p}src/ src/
+RUN --mount=type=cache,target=/usr/local/cargo/registry \\
+    --mount=type=cache,target=/app/target \\
+    cargo build --release${lockedFlag} --bin ${bin} && \\
+    cp target/release/${bin} /out-${bin}
+
+# ─── Stage 2: Runtime ─────────────────────────────────────
+FROM ${runtimeImage}
+WORKDIR /app
+
+RUN apt-get update && \\
+    apt-get install --no-install-recommends -y ca-certificates && \\
+    rm -rf /var/lib/apt/lists/* && \\
+    groupadd --system appgroup && \\
+    useradd --system --gid appgroup --home-dir /app appuser
+
+COPY --from=build /out-${bin} /usr/local/bin/${bin}
+
+USER appuser
+EXPOSE ${a.port}
+ENTRYPOINT ["/usr/local/bin/${bin}"]`.trim();
+
+  const improvements = [
+    `Rust release binary \`${bin}\` built with cargo${a.hasLock ? ' --locked' : ''} and shipped on ${runtimeImage}.`,
+    `EXPOSE ${a.port} is a default — set the real port (or pass a hint) if your service listens elsewhere.`,
+    'If you build a fully static binary (musl target), you can swap the runtime to a smaller base like distroless or scratch.',
+    'No HEALTHCHECK is emitted — add one pointing at your readiness endpoint.',
+  ];
+  return { dockerfile, dockerignore: rustDockerignore(), improvements };
+}
+
 // ── Helpers ──────────────────────────────────────────────────────────────────
 
 function installLine(packageManager, prodOnly) {
@@ -1412,4 +1599,28 @@ TestResults
 Dockerfile
 .dockerignore`.trim();
 }
+
+function goDockerignore() {
+  return `.git
+.gitignore
+.env
+.env.*
+*.md
+bin
+dist
+vendor
+Dockerfile
+.dockerignore`.trim();
+}
+
+function rustDockerignore() {
+  return `.git
+.gitignore
+.env
+.env.*
+*.md
+target
+Dockerfile
+.dockerignore`.trim();
+}
 module.exports = { generateDockerfile, addPowerDockerfileHeader };