# syntax=docker/dockerfile:1@sha256:4edf897a3ffa55b89f906fc8cc78afdb3f1834cc9c7083565e611a8a7d5fe99e
#
# Runtime-only image: it COPYs a prebuilt static (musl) binary. There is no
# Rust toolchain in the build, so `docker buildx` stays fast across
# linux/amd64 + linux/arm64 (TAD §6.4). The release pipeline (Task 3.7)
# builds the per-arch binaries into dist/<arch>/podspine;
# `docker buildx build --platform ...` selects by TARGETARCH.
#
# The base is Alpine: the binary is static musl, so no glibc is needed, and
# Alpine's ffmpeg keeps the image ~1/3 the size of debian-slim (the TAD
# sanctions this "if size matters", and it does: the ≤180MB target rules out
# debian's full ffmpeg).
FROM alpine:3.24@sha256:f59abe656b692d901e184be3445e084786602108599d2a51d229c0f5a48c71bf

# Upgrade the base packages first. openssl (libcrypto3/libssl3) ships inside the
# base image, so `apk add` alone keeps the digest-pinned version and never picks
# up a patched release from the branch. `apk upgrade` floats the base to the
# current v3.24 packages, which closes base CVEs (openssl and others) on rebuild.
# ffmpeg is the one runtime dependency; ca-certificates for outbound TLS if needed.
RUN apk upgrade --no-cache \
 && apk add --no-cache ffmpeg ca-certificates

# A non-root system user. Own /data before VOLUME, so that the anonymous
# volume Docker creates at runtime inherits podspine ownership (otherwise it
# cannot write the DB).
RUN adduser -D -H -u 10001 -s /sbin/nologin podspine \
 && mkdir -p /app /data \
 && chown podspine:podspine /app /data
WORKDIR /app

# Prebuilt static binary for the target architecture (amd64 or arm64).
ARG TARGETARCH
COPY dist/${TARGETARCH}/podspine /usr/local/bin/podspine

USER podspine
EXPOSE 8080

# Zero-config defaults: mount the library, keep data in a volume.
ENV PODSPINE_BIND=0.0.0.0:8080 \
    PODSPINE_LIBRARY=/library \
    PODSPINE_DATA_DIR=/data
VOLUME ["/data"]

ENTRYPOINT ["/usr/local/bin/podspine"]