# syntax=docker/dockerfile:1

# Minimal and secure runtime image
FROM debian:bookworm-slim AS runtime

# Install CA certificates and minimal runtime dynamic libraries
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        ca-certificates \
        libssl3 \
        zlib1g \
        libzstd1 && \
    rm -rf /var/lib/apt/lists/* /var/cache/apt/* && \
    groupadd -g 10001 appuser && \
    useradd -u 10001 -g appuser -d /home/appuser -m -s /usr/sbin/nologin appuser && \
    mkdir -p /home/appuser/.config/mirror-package \
             /home/appuser/.local/state/mirror-package \
             /home/appuser/.local/share/mirror-package \
             /etc/mirror-package && \
    chown -R appuser:appuser /home/appuser /etc/mirror-package

# Build argument pointing to the prebuilt binary
ARG TARGET_BIN=target/release/mirror-package
COPY ${TARGET_BIN} /usr/local/bin/mirror-package

# Set strict executable permissions
RUN chmod 0755 /usr/local/bin/mirror-package

# Run as unprivileged user
USER 10001:10001
WORKDIR /home/appuser

# Expose volume mount points for configuration and persistent state/logs
VOLUME ["/home/appuser/.config/mirror-package", "/home/appuser/.local/state/mirror-package"]

ENTRYPOINT ["/usr/local/bin/mirror-package"]
CMD ["--help"]
