FROM rust:1.98-trixie as builder

WORKDIR /app

COPY Cargo.toml Cargo.lock ./
COPY crates/ crates/

RUN cargo build --release --package herald-server


FROM debian:trixie-slim

# git clones the pull request. ca-certificates is what every HTTPS call needs
# (Gitea, OpenRouter, git). The shared libraries are the non-base ones the binary
# links against, as reported by `ldd target/release/herald-server`; libc, libm
# and libgcc_s come from the base image.
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    git \
    libssl3t64 \
    libzstd1 \
    zlib1g \
    && rm -rf /var/lib/apt/lists/*

# Herald drives the container daemon through its socket (DOCKER_HOST, default
# unix:///var/run/docker.sock), so neither docker nor podman is needed here: the
# compose file mounts the socket. Reaching that socket is what this user needs,
# and the socket is root-equivalent, so either run the container as root or give
# it the socket's group, e.g. `group_add: ["<gid of the host docker group>"]`.
RUN useradd --create-home --shell /usr/sbin/nologin --uid 10001 herald

WORKDIR /app
COPY --from=builder /app/target/release/herald-server ./herald-server

# git looks for its configuration under $HOME.
ENV HOME=/home/herald

USER herald

# Exec form, so the binary is PID 1 and receives the SIGTERM it handles to shut
# down gracefully.
CMD ["./herald-server"]