# clawmates-server: static musl build into distroless. The same image serves
# the air-gapped bundle and the cloud registry.
FROM rust:1.96-slim AS builder
ARG TARGETARCH
# git + cmake are needed for the clawhdf5 git dependency (fetched via the git
# CLI — libgit2 chokes on Gitea smart-HTTP) and its zlib-ng C build (cmake).
RUN apt-get update \
    && apt-get install -y --no-install-recommends musl-tools git cmake make pkg-config \
    && rm -rf /var/lib/apt/lists/*
WORKDIR /src
COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
COPY crates ./crates
COPY tools ./tools
COPY images/seccomp ./images/seccomp
COPY migrations ./migrations
COPY .sqlx ./.sqlx
# Install the musl target AFTER rust-toolchain.toml is in place, so rustup adds
# it to the toolchain the workspace pins (channel 1.96.0), not the base image's
# default. Doing this before the COPY installs into a toolchain cargo won't
# actually use, and the build then fails with E0463 (no core for musl).
RUN case "$TARGETARCH" in \
      arm64) echo aarch64-unknown-linux-musl > /rust-target ;; \
      *)     echo x86_64-unknown-linux-musl  > /rust-target ;; \
    esac \
    && rustup target add "$(cat /rust-target)"
ENV SQLX_OFFLINE=true
# Fetch git deps with the system git (libgit2 fails against Gitea smart-HTTP);
# build the zlib-ng C dep with the musl cross compiler for the static target.
ENV CARGO_NET_GIT_FETCH_WITH_CLI=true \
    CC_x86_64_unknown_linux_musl=musl-gcc \
    CC_aarch64_unknown_linux_musl=musl-gcc
RUN for attempt in 1 2 3; do \
        cargo build --release --target "$(cat /rust-target)" -p clawmates-server && break; \
        rc=$?; \
        echo "cargo build failed with exit $rc on attempt $attempt/3 — retrying in $((attempt*10))s"; \
        sleep $((attempt*10)); \
    done \
    && cp "target/$(cat /rust-target)/release/clawmates-server" /clawmates-server

FROM debian:12-slim
# git — required at runtime for research topic repo clones
# (routes/research_setup::ensure_repo_workspace shells out to `git clone`
# and `git ls-files`). The distroless variant we had here didn't include
# a git binary; every wizard-materialized research topic silently failed
# to clone until this change.
# ca-certificates — required by `git clone` over HTTPS.
#
# NO chromium. It was here for the Slice 6 mission PDF renderer, which is gone:
# every call site passes `render_pdf: false` (markdown is the deliverable), and
# NOTHING reads the CHROMIUM_BIN this image used to set — the only Chromium in
# the platform is `browser.goto`, which runs it inside the agent's dedicated
# egress-enabled BROWSER container (cm-runtime/src/tools/browser.rs), never
# here. It cost **758 MB of an 875 MB image**: chromium + fonts-liberation were
# 87% of the server image, shipped on every deploy, every registry push, and
# every air-gapped bundle.
RUN apt-get update \
    && apt-get install -y --no-install-recommends git ca-certificates \
    && rm -rf /var/lib/apt/lists/* \
    && useradd -u 65532 -M -s /usr/sbin/nologin nonroot
COPY --from=builder /clawmates-server /usr/local/bin/clawmates-server
# Builtin templates (team + workflow). Loader upserts them on boot.
COPY templates /etc/clawmates/templates
COPY skills /etc/clawmates/skills
# Normalize perms: the source dirs may arrive mode 700 (e.g. rsync -a
# preserving a developer's local dir perms), which would leave the
# nonroot runtime user unable to read them and silently skip the builtin
# skills/team-template seed. a+rX = dirs traversable, files readable.
RUN chmod -R a+rX /etc/clawmates/templates /etc/clawmates/skills
USER 65532
ENTRYPOINT ["/usr/local/bin/clawmates-server"]