Dockerfile

# Build stage
FROM rust:slim-bookworm AS builder
ENV RUSTFLAGS="-C target-cpu=native"

# Install build dependencies
RUN apt-get update && apt-get install -y \
    pkg-config \
    libssl-dev \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Create app directory
WORKDIR /app

# Copy manifests
COPY Cargo.toml Cargo.lock ./

# Create a dummy main.rs to build dependencies
RUN mkdir src && \
    echo "fn main() {}" > src/main.rs && \
    cargo build --release --bin rust-true && \
    rm -rf src

# Copy source code
COPY src ./src
COPY migrations ./migrations
COPY templates ./templates
COPY dashboard ./dashboard

# Build the application
RUN cargo build --release --bin rust-true

# Runtime stage - using Google's distroless image for minimal attack surface
FROM gcr.io/distroless/cc-debian12

# Use /home/nonroot which is pre-created with correct permissions in distroless
WORKDIR /home/nonroot

# Copy binary and assets (owned by nonroot)
COPY --from=builder --chown=nonroot:nonroot /app/target/release/rust-true ./rust-true
COPY --from=builder --chown=nonroot:nonroot /app/migrations ./migrations
COPY --from=builder --chown=nonroot:nonroot /app/templates ./templates
COPY --from=builder --chown=nonroot:nonroot /app/dashboard ./dashboard

# Expose port
EXPOSE 8080

# Run the application as non-root
USER nonroot:nonroot

# Run the application
CMD ["./rust-true"]