# The secret broker: its own minimal image, its own process boundary.
# Shares the builder pattern with the server image; ships ONLY the broker
# binary.
FROM rust:1-bookworm AS builder
RUN case "$(uname -m)" in \
      aarch64) echo aarch64-unknown-linux-musl > /rust-target ;; \
      *)       echo x86_64-unknown-linux-musl > /rust-target ;; \
    esac \
    && rustup target add "$(cat /rust-target)" \
    && apt-get update && apt-get install -y --no-install-recommends musl-tools \
    && rm -rf /var/lib/apt/lists/*
WORKDIR /src
COPY Cargo.toml rust-toolchain.toml ./
COPY crates ./crates
COPY tools ./tools
COPY images/seccomp ./images/seccomp
COPY migrations ./migrations
COPY .sqlx ./.sqlx
ENV SQLX_OFFLINE=true
RUN cargo build --release --target "$(cat /rust-target)" -p clawmates-broker \
    && cp "target/$(cat /rust-target)/release/clawmates-broker" /clawmates-broker

FROM scratch
COPY --from=builder /clawmates-broker /clawmates-broker
USER 10001:10001
ENTRYPOINT ["/clawmates-broker"]