Dockerfile.chef

# Optimized Dockerfile using cargo-chef for faster incremental builds
# This dramatically reduces build times by caching dependencies separately from source code

# Chef stage - prepare the recipe
FROM rust:slim-bookworm AS chef
RUN cargo install cargo-chef --version 0.1.70
WORKDIR /app

# Planner stage - generate recipe.json
FROM chef AS planner
COPY Cargo.toml Cargo.lock ./
COPY src ./src
RUN cargo chef prepare --recipe-path recipe.json

# Builder stage - build dependencies first, then app
FROM chef AS builder
ENV RUSTFLAGS="-C target-cpu=native"

# Install build dependencies
RUN apt-get update && apt-get install -y \
    pkg-config \
    libssl-dev \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Copy recipe and build dependencies
# This layer is cached unless Cargo.toml or Cargo.lock change
COPY --from=planner /app/recipe.json recipe.json

# Build dependencies (this is the slow part, but gets cached)
RUN cargo chef cook --release --recipe-path recipe.json

# Copy source code (changes frequently, but dependencies are already built)
COPY Cargo.toml Cargo.lock ./
COPY src ./src
COPY migrations ./migrations
COPY templates ./templates
COPY dashboard ./dashboard

# Build the application (fast because dependencies are cached)
ARG CARGO_BUILD_JOBS=4
ARG ENABLE_LTO=true
RUN if [ "$ENABLE_LTO" = "false" ]; then \
    sed -i 's/lto = true/lto = false/' Cargo.toml && \
    sed -i 's/codegen-units = 1/codegen-units = 16/' Cargo.toml; \
    fi && \
    cargo build --release --bin rust-true -j $CARGO_BUILD_JOBS

# Runtime stage - using Google's distroless image for minimal attack surface
FROM gcr.io/distroless/cc-debian12

# Create app directory
WORKDIR /app1

# Copy binary from builder
COPY --from=builder /app/target/release/rust-true /app/rust-true

# Copy migrations and templates
COPY --from=builder /app/migrations /app/migrations
COPY --from=builder /app/templates /app/templates
COPY --from=builder /app/dashboard /app/dashboard

# Expose port
EXPOSE 8080

# Run the application as non-root
USER nonroot:nonroot

# Run the application
CMD ["/app/rust-true"]