# syntax=docker/dockerfile:1.7

# ---- Build stage ----

FROM rust:1.96-bookworm AS builder

WORKDIR /app

# Cache dependencies: copy the manifest first, build a dummy target, then sources.

# Cargo.lock is committed in CI; if present it is honored, otherwise generated.

COPY Cargo.toml ./

COPY Cargo.lock* ./

RUN mkdir -p src \

    && echo 'fn main() {}' > src/main.rs \

    && echo '' > src/lib.rs \

    && cargo build --release || true \

    && rm -rf src

# Now copy the real sources and migrations and build for real.

COPY src ./src

COPY migrations ./migrations

# SQLx uses runtime queries (no compile-time DB checks), so no DB is needed here.

# Drop the dummy-crate fingerprint and artifacts so cargo recompiles the real

# sources (replacing src/ in place does not always invalidate the cached binary).

RUN rm -f target/release/drophawk-backend \

    && rm -rf target/release/deps/drophawk_backend-* target/release/deps/drophawk-backend-* \

    && find target/release/.fingerprint -maxdepth 1 -name 'drophawk*' -exec rm -rf {} + 2>/dev/null || true \

    && cargo build --release --bin drophawk-backend \

    && strip target/release/drophawk-backend

# ---- Runtime stage ----

# Distroless: minimal, no shell, runs as nonroot. cc variant provides libgcc/libc

# needed by the dynamically linked binary.

FROM gcr.io/distroless/cc-debian12:nonroot AS runtime

WORKDIR /app

# The binary and the migrations it applies at startup.

COPY --from=builder /app/target/release/drophawk-backend /usr/local/bin/drophawk-backend

COPY --from=builder /app/migrations /app/migrations

EXPOSE 8080

USER nonroot:nonroot

ENTRYPOINT ["/usr/local/bin/drophawk-backend"]