cyberia 3.2.12 → 3.2.70

package/src/runtime/cyberia-server/Dockerfile.dev

@@ -1,23 +1,6 @@
 # cyberia-server DEV runtime image.
-#
-# Differences vs the production Dockerfile in this same directory:
-#   - Builds the Go binary WITHOUT `-trimpath -ldflags="-s -w"` so symbols
-#     and source paths survive into the binary for stack traces and pprof.
-#   - Keeps -race (CGO-free race detector is not available; we still pass
-#     `-gcflags="all=-N -l"` to disable inlining + optimisations so the
-#     dlv debugger and live profilers can attach predictably).
-#   - Keeps `git`, `procps-ng`, `strace`, `lsof`, `vim`, `curl` in the
-#     runtime image so the operator can attach and inspect a misbehaving
-#     pod without re-baking the image. Production keeps the runtime
-#     layer minimal.
-#   - Does NOT strip the npm cache after `npm install -g underpost@…` so
-#     `npm upgrade -g underpost` works in a running container.
-#
-# Selected automatically by `node bin run instance-build-manifest`
-# whenever the `--dev` flag is set; the production Dockerfile in the
-# same directory is used otherwise.
 
-# --- Build Image
+# --- Build Image ---
 FROM rockylinux/rockylinux:9 AS builder
 
 RUN dnf -y update && \
@@ -30,40 +13,42 @@ RUN dnf -y update && \
 
 WORKDIR /build
 
-# Build context is the cyberia-server project repo root (see the
-# production Dockerfile in this directory for the rationale).
 COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . ./
-# Dev build: keep source paths, disable inlining + optimisations.
+
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
       go build -gcflags="all=-N -l" -o server ./cmd/cyberia-server/ && \
     echo "DEV build complete: $(pwd)/server"
 
-# --- Runtime Image
+# --- Runtime Image ---
 FROM rockylinux/rockylinux:9 AS runtime
 
-ARG UNDERPOST_VERSION=3.2.9
-RUN dnf -y update && \
-    dnf -y install epel-release && \
+ARG UNDERPOST_VERSION=3.2.70
+ARG NODE_VERSION=24.15.0
+RUN set -eux; \
+    dnf -y update; \
+    dnf -y install epel-release; \
     dnf -y install --allowerasing \
-        curl git \
-        procps-ng strace lsof vim-minimal && \
-    curl -fsSL https://rpm.nodesource.com/setup_24.x | bash - && \
-    dnf install -y nodejs && \
-    npm install -g underpost@${UNDERPOST_VERSION} && \
+        curl git tar xz \
+        procps-ng strace lsof vim-minimal; \
+    arch="$(uname -m)"; \
+    case "$arch" in \
+      x86_64) node_arch=x64 ;; \
+      aarch64) node_arch=arm64 ;; \
+      *) echo "unsupported arch: $arch" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${node_arch}.tar.xz" \
+      | tar -xJ -C /usr/local --strip-components=1; \
+    node --version; npm --version; \
+    npm install -g underpost@${UNDERPOST_VERSION}; \
     dnf clean all
 
 WORKDIR /home/dd/engine/cyberia-server
 
 COPY --from=builder /build/server ./server
 
-# Static SSR dashboard — required by the Go server's findPublicDir() at boot.
-# See the production Dockerfile in this directory for the full rationale.
-# The same `node bin/cyberia run-workflow build-server-dashboard --dev
-# --output-path <project-root>/public/index.html` command is executed by
-# the CI workflow before docker build.
 COPY public/ ./public/
 
 EXPOSE 8081

package/src/runtime/engine-cyberia/Dockerfile

@@ -0,0 +1,143 @@
+# syntax=docker/dockerfile:1.7
+#
+# engine-cyberia — PRODUCTION image (underpost/engine-cyberia).
+#
+# ---------------------------------------------------------------------------
+# Stage 1 — builder: clone the private deploy, build it, then scrub secrets.
+# ---------------------------------------------------------------------------
+FROM rockylinux/rockylinux:9 AS builder
+ARG UNDERPOST_VERSION=3.2.70
+# Pin Node to an exact patch: dnf's nodejs:24 module lags (24.14.1) while
+# underpost's dependencies require >=24.15.0, so install the official binary.
+ARG NODE_VERSION=24.15.0
+ENV NODE_ENV=production
+
+RUN set -eux; \
+    # `sudo` is required because underpost's build steps shell out to
+    # `sudo cp`/`sudo rm` (src/server/start.js); the build runs as root so sudo
+    # is just a passthrough, but the binary must exist.
+    dnf install -y git openssl tar xz sudo; \
+    arch="$(uname -m)"; \
+    case "$arch" in \
+      x86_64) node_arch=x64 ;; \
+      aarch64) node_arch=arm64 ;; \
+      *) echo "unsupported arch: $arch" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${node_arch}.tar.xz" \
+      | tar -xJ -C /usr/local --strip-components=1; \
+    node --version; npm --version; \
+    npm install -g underpost@${UNDERPOST_VERSION}; \
+    dnf clean all; rm -rf /var/cache/dnf; \
+    npm cache clean --force
+
+WORKDIR /home/dd
+
+RUN --mount=type=secret,id=github_username \
+    # --mount=type=secret,id=github_token \
+    set -eu; \
+    export GITHUB_USERNAME="$(cat /run/secrets/github_username)"; \
+    # export GITHUB_TOKEN="$(cat /run/secrets/github_token)"; \
+    export ENGINE_CYBERIA_REPO="engine-cyberia"; \
+    export INSTANCE_CODE="amethyst-strata-expansion"; \
+    cd /home/dd; \
+    underpost clone "$GITHUB_USERNAME/$ENGINE_CYBERIA_REPO"; \
+    mkdir -p /home/dd/engine; \
+    cp -a ./"$ENGINE_CYBERIA_REPO"/. /home/dd/engine/; \
+    rm -rf ./"$ENGINE_CYBERIA_REPO"; \
+    cd /home/dd; \
+    underpost clone "$GITHUB_USERNAME/cyberia-instances"; \
+    rm -rf /home/dd/engine/engine-private; \
+    mkdir -p /home/dd/engine/engine-private/conf/dd-cyberia; \
+    cp -a ./cyberia-instances/conf/dd-cyberia/. /home/dd/engine/engine-private/conf/dd-cyberia/.; \
+    cp -a /home/dd/engine/package.json /home/dd/engine/engine-private/conf/dd-cyberia/package.json; \
+    mkdir -p /home/dd/engine/engine-private/cyberia-instances; \
+    cp -a ./cyberia-instances/instances/"$INSTANCE_CODE" /home/dd/engine/engine-private/cyberia-instances/"$INSTANCE_CODE"; \
+    mkdir -p /home/dd/engine/src/client/public/cyberia; \
+    cp -a ./cyberia-instances/public/cyberia/. /home/dd/engine/src/client/public/cyberia/.; \
+    # The engine gRPC server loads its schema at runtime from
+    # cyberia-server/gen/proto/cyberia.proto (src/grpc/cyberia/grpc-server.js);
+    # fetch just that file so the engine can bind :50051 / :4005 without the
+    # full cyberia-server repo.
+    underpost clone "$GITHUB_USERNAME/cyberia-server"; \
+    mkdir -p /home/dd/engine/cyberia-server/gen/proto; \
+    cp -a ./cyberia-server/gen/proto/cyberia.proto /home/dd/engine/cyberia-server/gen/proto/cyberia.proto; \
+    rm -rf ./cyberia-server; \
+    cd /home/dd/engine; \
+    # --- install deps + env, then replay build-safe itc provisioning ----------
+    npm install; \
+    node bin env dd-cyberia production; \
+    ( cd /home/dd/engine/hardhat && npm install --include=dev ); \
+    # --- build the client bundle (assets are now in place) --------------------
+    cd /home/dd/engine; \
+    node bin client dd-cyberia; \
+    # --- CREDENTIAL SCRUB (defense in depth, while secrets are still in scope) -
+    # 1) Redact every real secret value from any file it may have reached.
+    # for _secret in "$GITHUB_TOKEN" "$CLOUDINARY_API_SECRET" "$CLOUDINARY_API_KEY"; do \
+    for _secret in "$GITHUB_USERNAME"; do \
+    # for _secret in "$GITHUB_USERNAME" "$GITHUB_TOKEN"; do \
+      [ -n "$_secret" ] || continue; \
+      grep -rlF --exclude-dir=node_modules --exclude-dir=.git "$_secret" /home/dd/engine 2>/dev/null \
+        | xargs -r sed -i "s#${_secret}#__REDACTED__#g" || true; \
+    done; \
+    # unset GITHUB_TOKEN GITHUB_USERNAME; \
+    # unset GITHUB_TOKEN GITHUB_USERNAME CLOUDINARY_CLOUD_NAME CLOUDINARY_API_KEY CLOUDINARY_API_SECRET; \
+    unset GITHUB_USERNAME; \
+
+    # 2) Every .git dir — clone URLs embed the token in .git/config, and the
+    #    private history itself must not ship.
+    find /home/dd/engine -type d -name .git -prune -exec rm -rf {} + 2>/dev/null || true; \
+    # 3) User-level credential stores possibly written during the build.
+    rm -rf /root/.gitconfig /root/.git-credentials /root/.config/git \
+           /root/.netrc /root/.ssh /root/.npm /root/.cache /root/.node-gyp; \
+    # 4) The underpost global env store may hold GITHUB_TOKEN.
+    rm -f "$(underpost root)/underpost/.env" 2>/dev/null || true; \
+    # 5) Build caches, temp, and build-only toolchains. hardhat is contract
+    #    build/CLI tooling (used only to build the coverage docs above); the
+    #    runtime server never imports it, so its dev node_modules is pure bloat.
+    npm cache clean --force 2>/dev/null || true; \
+    rm -rf /home/dd/cyberia-instances \
+           /home/dd/engine/src/client/public/itemledger \
+           /home/dd/engine/src/client/public/cryptokoyn \
+           /home/dd/engine/src/client/components/cryptokoyn \
+           /home/dd/engine/src/client/components/itemledger \
+           /home/dd/engine/src/client/Itemledger.index.js \
+           /home/dd/engine/src/client/Cryptokoyn.index.js \
+           /home/dd/engine/hardhat/node_modules \
+           /home/dd/engine/.npm /tmp/* /var/tmp/* /var/cache/dnf
+
+# ---------------------------------------------------------------------------
+# Stage 2 — runtime: clean base + pinned Node toolchain + scrubbed app tree.
+# ---------------------------------------------------------------------------
+FROM rockylinux/rockylinux:9 AS runtime
+ENV NODE_ENV=production
+
+# Node + npm + the underpost CLI (exact pinned version) from the builder — no
+# re-download, no git/build toolchain. libstdc++ is the only runtime lib the
+# prebuilt Node binary needs beyond the base image.
+COPY --from=builder /usr/local/ /usr/local/
+RUN dnf install -y libstdc++ git sudo && dnf clean all && rm -rf /var/cache/dnf && \
+    useradd --create-home --home-dir /home/dd --shell /usr/sbin/nologin dd && \
+    # The runtime runs as `dd`, but `underpost start --build` shells out to `sudo cp`/`sudo rm`
+    # (src/server/start.js). Grant passwordless sudo so those succeed without a TTY/password.
+    printf 'dd ALL=(ALL) NOPASSWD:ALL\n' > /etc/sudoers.d/dd && chmod 0440 /etc/sudoers.d/dd && \
+    # underpost persists its global env at $(npm root -g)/underpost/.env; the
+    # non-root runtime user must be able to write it (fixes EACCES on start).
+    chown -R dd:dd /usr/local/lib/node_modules/underpost
+
+# Copy ONLY the scrubbed runtime tree — no .git, no token, no caches.
+COPY --from=builder --chown=dd:dd /home/dd/engine /home/dd/engine
+
+RUN chmod +x /home/dd/engine/scripts/rpmfusion-ffmpeg-setup.sh && \
+    /home/dd/engine/scripts/rpmfusion-ffmpeg-setup.sh
+
+# Explicit re-chown: PVC-backed mounts under src/client/public land here at
+# pod start and may override the COPY --chown above with root ownership.
+RUN chown -R dd:dd /home/dd/engine/src/client/public
+
+USER dd
+WORKDIR /home/dd/engine
+
+EXPOSE 3005
+EXPOSE 50051
+
+CMD ["/bin/sh", "-c", "underpost start --run dd-cyberia production"]

package/src/runtime/engine-cyberia/Dockerfile.dev

@@ -0,0 +1,143 @@
+# syntax=docker/dockerfile:1.7
+#
+# engine-cyberia — DEVELOPMENT image (underpost/engine-cyberia-dev).
+#
+# ---------------------------------------------------------------------------
+# Stage 1 — builder: clone the private deploy, build it, then scrub secrets.
+# ---------------------------------------------------------------------------
+FROM rockylinux/rockylinux:9 AS builder
+ARG UNDERPOST_VERSION=3.2.70
+# Pin Node to an exact patch: dnf's nodejs:24 module lags (24.14.1) while
+# underpost's dependencies require >=24.15.0, so install the official binary.
+ARG NODE_VERSION=24.15.0
+ENV NODE_ENV=development
+
+RUN set -eux; \
+    # `sudo` is required because underpost's build steps shell out to
+    # `sudo cp`/`sudo rm` (src/server/start.js); the build runs as root so sudo
+    # is just a passthrough, but the binary must exist.
+    dnf install -y git openssl tar xz sudo; \
+    arch="$(uname -m)"; \
+    case "$arch" in \
+      x86_64) node_arch=x64 ;; \
+      aarch64) node_arch=arm64 ;; \
+      *) echo "unsupported arch: $arch" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${node_arch}.tar.xz" \
+      | tar -xJ -C /usr/local --strip-components=1; \
+    node --version; npm --version; \
+    npm install -g underpost@${UNDERPOST_VERSION}; \
+    dnf clean all; rm -rf /var/cache/dnf; \
+    npm cache clean --force
+
+WORKDIR /home/dd
+
+RUN --mount=type=secret,id=github_username \
+    # --mount=type=secret,id=github_token \
+    set -eu; \
+    export GITHUB_USERNAME="$(cat /run/secrets/github_username)"; \
+    # export GITHUB_TOKEN="$(cat /run/secrets/github_token)"; \
+    export ENGINE_CYBERIA_REPO="engine-cyberia"; \
+    export INSTANCE_CODE="amethyst-strata-expansion"; \
+    cd /home/dd; \
+    underpost clone "$GITHUB_USERNAME/$ENGINE_CYBERIA_REPO"; \
+    mkdir -p /home/dd/engine; \
+    cp -a ./"$ENGINE_CYBERIA_REPO"/. /home/dd/engine/; \
+    rm -rf ./"$ENGINE_CYBERIA_REPO"; \
+    cd /home/dd; \
+    underpost clone "$GITHUB_USERNAME/cyberia-instances"; \
+    rm -rf /home/dd/engine/engine-private; \
+    mkdir -p /home/dd/engine/engine-private/conf/dd-cyberia; \
+    cp -a ./cyberia-instances/conf/dd-cyberia/. /home/dd/engine/engine-private/conf/dd-cyberia/.; \
+    cp -a /home/dd/engine/package.json /home/dd/engine/engine-private/conf/dd-cyberia/package.json; \
+    mkdir -p /home/dd/engine/engine-private/cyberia-instances; \
+    cp -a ./cyberia-instances/instances/"$INSTANCE_CODE" /home/dd/engine/engine-private/cyberia-instances/"$INSTANCE_CODE"; \
+    mkdir -p /home/dd/engine/src/client/public/cyberia; \
+    cp -a ./cyberia-instances/public/cyberia/. /home/dd/engine/src/client/public/cyberia/.; \
+    # The engine gRPC server loads its schema at runtime from
+    # cyberia-server/gen/proto/cyberia.proto (src/grpc/cyberia/grpc-server.js);
+    # fetch just that file so the engine can bind :50051 / :4005 without the
+    # full cyberia-server repo.
+    underpost clone "$GITHUB_USERNAME/cyberia-server"; \
+    mkdir -p /home/dd/engine/cyberia-server/gen/proto; \
+    cp -a ./cyberia-server/gen/proto/cyberia.proto /home/dd/engine/cyberia-server/gen/proto/cyberia.proto; \
+    rm -rf ./cyberia-server; \
+    cd /home/dd/engine; \
+    # --- install deps + env, then replay build-safe itc provisioning ----------
+    npm install; \
+    node bin env dd-cyberia development; \
+    ( cd /home/dd/engine/hardhat && npm install --include=dev ); \
+    # --- build the client bundle (assets are now in place) --------------------
+    cd /home/dd/engine; \
+    node bin client dd-cyberia; \
+    # --- CREDENTIAL SCRUB (defense in depth, while secrets are still in scope) -
+    # 1) Redact every real secret value from any file it may have reached.
+    # for _secret in "$GITHUB_TOKEN" "$CLOUDINARY_API_SECRET" "$CLOUDINARY_API_KEY"; do \
+    for _secret in "$GITHUB_USERNAME"; do \
+    # for _secret in "$GITHUB_USERNAME" "$GITHUB_TOKEN"; do \
+      [ -n "$_secret" ] || continue; \
+      grep -rlF --exclude-dir=node_modules --exclude-dir=.git "$_secret" /home/dd/engine 2>/dev/null \
+        | xargs -r sed -i "s#${_secret}#__REDACTED__#g" || true; \
+    done; \
+    # unset GITHUB_TOKEN GITHUB_USERNAME; \
+    # unset GITHUB_TOKEN GITHUB_USERNAME CLOUDINARY_CLOUD_NAME CLOUDINARY_API_KEY CLOUDINARY_API_SECRET; \
+    unset GITHUB_USERNAME; \
+
+    # 2) Every .git dir — clone URLs embed the token in .git/config, and the
+    #    private history itself must not ship.
+    find /home/dd/engine -type d -name .git -prune -exec rm -rf {} + 2>/dev/null || true; \
+    # 3) User-level credential stores possibly written during the build.
+    rm -rf /root/.gitconfig /root/.git-credentials /root/.config/git \
+           /root/.netrc /root/.ssh /root/.npm /root/.cache /root/.node-gyp; \
+    # 4) The underpost global env store may hold GITHUB_TOKEN.
+    rm -f "$(underpost root)/underpost/.env" 2>/dev/null || true; \
+    # 5) Build caches, temp, and build-only toolchains. hardhat is contract
+    #    build/CLI tooling (used only to build the coverage docs above); the
+    #    runtime server never imports it, so its dev node_modules is pure bloat.
+    npm cache clean --force 2>/dev/null || true; \
+    rm -rf /home/dd/cyberia-instances \
+           /home/dd/engine/src/client/public/itemledger \
+           /home/dd/engine/src/client/public/cryptokoyn \
+           /home/dd/engine/src/client/components/cryptokoyn \
+           /home/dd/engine/src/client/components/itemledger \
+           /home/dd/engine/src/client/Itemledger.index.js \
+           /home/dd/engine/src/client/Cryptokoyn.index.js \
+           /home/dd/engine/hardhat/node_modules \
+           /home/dd/engine/.npm /tmp/* /var/tmp/* /var/cache/dnf
+
+# ---------------------------------------------------------------------------
+# Stage 2 — runtime: clean base + pinned Node toolchain + scrubbed app tree.
+# ---------------------------------------------------------------------------
+FROM rockylinux/rockylinux:9 AS runtime
+ENV NODE_ENV=development
+
+# Node + npm + the underpost CLI (exact pinned version) from the builder — no
+# re-download, no git/build toolchain. libstdc++ is the only runtime lib the
+# prebuilt Node binary needs beyond the base image.
+COPY --from=builder /usr/local/ /usr/local/
+RUN dnf install -y libstdc++ git sudo && dnf clean all && rm -rf /var/cache/dnf && \
+    useradd --create-home --home-dir /home/dd --shell /usr/sbin/nologin dd && \
+    # The runtime runs as `dd`, but `underpost start --build` shells out to `sudo cp`/`sudo rm`
+    # (src/server/start.js). Grant passwordless sudo so those succeed without a TTY/password.
+    printf 'dd ALL=(ALL) NOPASSWD:ALL\n' > /etc/sudoers.d/dd && chmod 0440 /etc/sudoers.d/dd && \
+    # underpost persists its global env at $(npm root -g)/underpost/.env; the
+    # non-root runtime user must be able to write it (fixes EACCES on start).
+    chown -R dd:dd /usr/local/lib/node_modules/underpost
+
+# Copy ONLY the scrubbed runtime tree — no .git, no token, no caches.
+COPY --from=builder --chown=dd:dd /home/dd/engine /home/dd/engine
+
+RUN chmod +x /home/dd/engine/scripts/rpmfusion-ffmpeg-setup.sh && \
+    /home/dd/engine/scripts/rpmfusion-ffmpeg-setup.sh
+
+# Explicit re-chown: PVC-backed mounts under src/client/public land here at
+# pod start and may override the COPY --chown above with root ownership.
+RUN chown -R dd:dd /home/dd/engine/src/client/public
+
+USER dd
+WORKDIR /home/dd/engine
+
+EXPOSE 4005
+EXPOSE 50051
+
+CMD ["/bin/sh", "-c", "underpost start --run dd-cyberia development"]

package/src/runtime/engine-cyberia/Dockerfile.test

@@ -0,0 +1,165 @@
+# syntax=docker/dockerfile:1.7
+#
+# engine-cyberia — DEVELOPMENT image (underpost/engine-cyberia-dev).
+#
+# ---------------------------------------------------------------------------
+# Stage 1 — builder: clone the private deploy, build it, then scrub secrets.
+# ---------------------------------------------------------------------------
+FROM rockylinux/rockylinux:9 AS builder
+ARG UNDERPOST_VERSION=3.2.70
+# Pin Node to an exact patch: dnf's nodejs:24 module lags (24.14.1) while
+# underpost's dependencies require >=24.15.0, so install the official binary.
+ARG NODE_VERSION=24.15.0
+ENV NODE_ENV=development
+
+RUN set -eux; \
+    # `sudo` is required because underpost's build steps shell out to
+    # `sudo cp`/`sudo rm` (src/server/start.js); the build runs as root so sudo
+    # is just a passthrough, but the binary must exist.
+    dnf install -y git openssl tar xz sudo; \
+    arch="$(uname -m)"; \
+    case "$arch" in \
+      x86_64) node_arch=x64 ;; \
+      aarch64) node_arch=arm64 ;; \
+      *) echo "unsupported arch: $arch" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${node_arch}.tar.xz" \
+      | tar -xJ -C /usr/local --strip-components=1; \
+    node --version; npm --version; \
+    npm install -g underpost@${UNDERPOST_VERSION}; \
+    dnf clean all; rm -rf /var/cache/dnf; \
+    npm cache clean --force
+
+WORKDIR /home/dd
+
+# Single hermetic RUN: GitHub credentials are mounted as secrets (readable only
+# here, never persisted), used to clone + build the private dd-cyberia deploy,
+# then every credential/secret/VCS trace is removed BEFORE this layer commits.
+RUN --mount=type=secret,id=github_token \
+    --mount=type=secret,id=github_username \
+    --mount=type=secret,id=cloudinary_cloud_name \
+    --mount=type=secret,id=cloudinary_api_key \
+    --mount=type=secret,id=cloudinary_api_secret \
+    set -eu; \
+    export GITHUB_TOKEN="$(cat /run/secrets/github_token)"; \
+    export GITHUB_USERNAME="$(cat /run/secrets/github_username)"; \
+    # Cloudinary creds power the `node bin fs --pull` asset downloads below; they
+    # are optional (empty when not provided) so builds that don't need assets
+    # still work.
+    export CLOUDINARY_CLOUD_NAME="$(cat /run/secrets/cloudinary_cloud_name 2>/dev/null || true)"; \
+    export CLOUDINARY_API_KEY="$(cat /run/secrets/cloudinary_api_key 2>/dev/null || true)"; \
+    export CLOUDINARY_API_SECRET="$(cat /run/secrets/cloudinary_api_secret 2>/dev/null || true)"; \
+    \
+    # --- fetch sources under our control, then build WITHOUT itc-scripts -----
+    # itc-scripts are DEPLOY-time provisioning; the DB-seeding parts (`cyberia
+    # ol --drop`, `instance --import`) and the in-cluster .env rewrite cannot run
+    # in a hermetic build, so we strip the scripts and replay ONLY the build-safe
+    # provisioning steps inline (asset pulls, ffmpeg, hardhat deps, cyberia-server
+    # clone). Pre-clone so privateEngineRepoFactory no-ops and --skip-pull-base
+    # reuses the tree.
+    export ENGINE_CYBERIA_REPO="engine-cyberia"; \
+    cd /home/dd; \
+    underpost clone "$GITHUB_USERNAME/$ENGINE_CYBERIA_REPO"; \
+    mkdir -p /home/dd/engine; \
+    cp -a ./"$ENGINE_CYBERIA_REPO"/. /home/dd/engine/; \
+    rm -rf ./"$ENGINE_CYBERIA_REPO"; \
+    cd /home/dd/engine; \
+    rm -rf ./engine-private; \
+    underpost clone "$GITHUB_USERNAME/engine-cyberia-private"; \
+    mv ./engine-cyberia-private ./engine-private; \
+    rm -rf ./engine-private/itc-scripts; \
+    \
+    # --- install deps + env, then replay build-safe itc provisioning ----------
+    npm install; \
+    node bin env dd-cyberia development; \
+    node bin fs --pull --recursive --deploy-id dd-cyberia --storage-file-path './engine-private/conf/dd-cyberia/storage.engine-cyberia.json'; \
+    ( cd /home/dd/engine/hardhat && npm install --include=dev ); \
+    ( cd /home/dd/engine && underpost clone underpostnet/cyberia-server ); \
+    \
+    # --- build the client bundle (assets are now in place) --------------------
+    node bin client dd-cyberia; \
+    \
+    # --- bake NON-secret env (placeholders; real creds come from runtime env) -
+    CONF=/home/dd/engine/engine-private/conf/dd-cyberia; \
+    cp -a "$CONF/docker-compose/cyberia/compose.env" "$CONF/.env.development"; \
+    cp -a "$CONF/docker-compose/cyberia/compose.env" "$CONF/.env.production"; \
+    cp -a "$CONF/docker-compose/cyberia/compose.env" "$CONF/.env.test"; \
+    cp -a "$CONF/conf.server.dev.dev.json" "$CONF/conf.server.json"; \
+    cp -a "$CONF/docker-compose/cyberia/compose.env" /home/dd/engine/.env; \
+    \
+    # --- drop build-only / non-runtime private material ----------------------
+    rm -rf /home/dd/engine/engine-private/itc-scripts; \
+    rm -rf /home/dd/engine/engine-private/cyberia-instances/FOREST; \
+    rm -rf /home/dd/engine/engine-private/logs; \
+    rm -rf "$CONF/build" "$CONF/instances"; \
+    rm -rf "$CONF/conf.instances.json"; \
+    rm -rf "$CONF/conf.server.dev.underpost.json"; \
+    rm -rf "$CONF/storage.bundle.json"; \
+    rm -rf "$CONF/storage.json"; \
+    rm -rf "$CONF/storage.underpost.json"; \
+    \
+    # --- CREDENTIAL SCRUB (defense in depth, while secrets are still in scope) -
+    # 1) Redact every real secret value from any file it may have reached.
+    for _secret in "$GITHUB_TOKEN" "$CLOUDINARY_API_SECRET" "$CLOUDINARY_API_KEY"; do \
+      [ -n "$_secret" ] || continue; \
+      grep -rlF --exclude-dir=node_modules --exclude-dir=.git "$_secret" /home/dd/engine 2>/dev/null \
+        | xargs -r sed -i "s#${_secret}#__REDACTED__#g" || true; \
+    done; \
+    unset GITHUB_TOKEN GITHUB_USERNAME CLOUDINARY_CLOUD_NAME CLOUDINARY_API_KEY CLOUDINARY_API_SECRET; \
+    # 2) Every .git dir — clone URLs embed the token in .git/config, and the
+    #    private history itself must not ship.
+    find /home/dd/engine -type d -name .git -prune -exec rm -rf {} + 2>/dev/null || true; \
+    # 3) User-level credential stores possibly written during the build.
+    rm -rf /root/.gitconfig /root/.git-credentials /root/.config/git \
+           /root/.netrc /root/.ssh /root/.npm /root/.cache /root/.node-gyp; \
+    # 4) The underpost global env store may hold GITHUB_TOKEN.
+    rm -f "$(underpost root)/underpost/.env" 2>/dev/null || true; \
+    # 5) Build caches, temp, and build-only toolchains. hardhat is contract
+    #    build/CLI tooling (used only to build the coverage docs above); the
+    #    runtime server never imports it, so its dev node_modules is pure bloat.
+    npm cache clean --force 2>/dev/null || true; \
+    rm -rf /home/dd/engine/src/client/public/itemledger \
+    rm -rf /home/dd/engine/src/client/public/cryptokoyn \
+    rm -rf /home/dd/engine/src/client/components/cryptokoyn \
+    rm -rf /home/dd/engine/src/client/components/itemledger \
+    rm -rf /home/dd/engine/src/client/Itemledger.index.js \
+    rm -rf /home/dd/engine/src/client/Cryptokoyn.index.js \
+    rm -rf /home/dd/engine/hardhat/node_modules \
+           /home/dd/engine/.npm /tmp/* /var/tmp/* /var/cache/dnf
+
+# ---------------------------------------------------------------------------
+# Stage 2 — runtime: clean base + pinned Node toolchain + scrubbed app tree.
+# ---------------------------------------------------------------------------
+FROM rockylinux/rockylinux:9 AS runtime
+ENV NODE_ENV=development
+
+# Node + npm + the underpost CLI (exact pinned version) from the builder — no
+# re-download, no git/build toolchain. libstdc++ is the only runtime lib the
+# prebuilt Node binary needs beyond the base image.
+COPY --from=builder /usr/local/ /usr/local/
+RUN dnf install -y libstdc++ git sudo && dnf clean all && rm -rf /var/cache/dnf && \
+    useradd --create-home --home-dir /home/dd --shell /usr/sbin/nologin dd && \
+    # The runtime runs as `dd`, but `underpost start --build` shells out to `sudo cp`/`sudo rm`
+    # (src/server/start.js). Grant passwordless sudo so those succeed without a TTY/password.
+    printf 'dd ALL=(ALL) NOPASSWD:ALL\n' > /etc/sudoers.d/dd && chmod 0440 /etc/sudoers.d/dd && \
+    # underpost persists its global env at $(npm root -g)/underpost/.env; the
+    # non-root runtime user must be able to write it (fixes EACCES on start).
+    chown -R dd:dd /usr/local/lib/node_modules/underpost
+
+# Copy ONLY the scrubbed runtime tree — no .git, no token, no caches.
+COPY --from=builder --chown=dd:dd /home/dd/engine /home/dd/engine
+
+RUN chmod +x /home/dd/engine/scripts/rpmfusion-ffmpeg-setup.sh && \
+    /home/dd/engine/scripts/rpmfusion-ffmpeg-setup.sh
+
+# Explicit re-chown: PVC-backed mounts under src/client/public land here at
+# pod start and may override the COPY --chown above with root ownership.
+RUN chown -R dd:dd /home/dd/engine/src/client/public
+
+USER dd
+WORKDIR /home/dd/engine
+
+EXPOSE 4005
+EXPOSE 50051
+
+CMD ["/bin/sh", "-c", "underpost start --run dd-cyberia development"]