chore: 添加 Docker 打包和 Compose 编排支持

.dockerignore

@@ -0,0 +1,14 @@
+node_modules/
+.output/
+.tanstack/
+out/
+.git/
+.env
+.env.*
+
+*.md
+*.tsbuildinfo
+*.bun-build
+
+.vscode/
+drizzle/

AGENTS.md

@@ -23,6 +23,9 @@ bun run db:generate            # Generate migration SQL files (for production)
 bun run db:migrate             # Apply migrations (production deployment)
 bun run db:studio              # Drizzle Studio GUI
 bun test path/to/test.ts       # Run single test (not yet configured)
+docker compose up --build      # Build image & start app + postgres
+docker compose up -d           # Start in background (detached)
+docker compose down            # Stop and remove containers
 ```
 
 ## Code Style
@@ -118,6 +121,14 @@ const handler = new RPCHandler(router, {
 
 **DON'T:** `npm`/`npx`/`node`/`yarn`/`pnpm` | Edit `routeTree.gen.ts` | `as any`/`@ts-ignore`/`@ts-expect-error` | Commit `.env` | Empty catch blocks | Import from `drizzle-zod` | RQBv1 callback-style API | `drizzle-orm/bun-sql` driver | Pass `schema` to `drizzle()` | Import `os` from `@orpc/server` in middleware (use `@/server/api/server`) | Leave docs out of sync
 
+## Docker
+
+- **Dockerfile**: Multi-stage — `oven/bun:1` (build + compile) → `gcr.io/distroless/cc-debian13:nonroot` (runtime)
+- **Runtime**: Bun-compiled standalone binary (glibc-linked, requires `cc` distroless variant)
+- **Compose**: `app` (port 3000) + `postgres:17-alpine` (port 5432) with health check
+- **Migrations**: Run separately — `bun run db:push` (dev) or `bun run db:migrate` (prod) against the compose DB
+- **Env**: `DATABASE_URL` set in `compose.yaml` pointing to the `db` service
+
 ## Git Workflow
 
 1. Make changes → 2. `bun run fix` → 3. `bun run typecheck` → 4. `bun run dev` (test) → 5. Commit

Dockerfile

@@ -0,0 +1,20 @@
+FROM oven/bun:1 AS build
+
+WORKDIR /app
+
+COPY package.json bun.lock ./
+RUN bun install --frozen-lockfile
+
+COPY . .
+RUN bun run build \
+    && bun run compile \
+    && mv out/server-* out/server
+
+FROM gcr.io/distroless/cc-debian13:nonroot
+
+COPY --from=build --chown=nonroot:nonroot /app/out/server /app/server
+
+ENV HOST=0.0.0.0
+EXPOSE 3000
+
+CMD ["/app/server"]

compose.yaml

@@ -0,0 +1,29 @@
+services:
+  app:
+    build: .
+    ports:
+      - '3000:3000'
+    environment:
+      DATABASE_URL: postgres://postgres:postgres@db:5432/postgres
+    depends_on:
+      db:
+        condition: service_healthy
+
+  db:
+    image: postgres:17-alpine
+    # ports:
+    #   - '5432:5432'
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres
+      POSTGRES_DB: postgres
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ['CMD', 'pg_isready', '-U', 'postgres']
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+volumes:
+  pgdata: