# SPDX-License-Identifier: PMPL-1.0-or-later
# anvomidaviser Container Image
#
# Multi-stage build template for Chainguard Wolfi base images.
# Customise the builder stage for your language and copy the
# resulting binary/release into the minimal runtime stage.
#
# Build with Podman:
#   podman build -t anvomidaviser:latest -f container/Containerfile .
#
# Run:
#   podman run -p 8080:8080 anvomidaviser:latest
#
# Run with persistent volume:
#   podman run -p 8080:8080 -v anvomidaviser-data:/data anvomidaviser:latest

# ============================================================================
# Stage 1: Builder
# ============================================================================
#
# Install build tools and compile the application.
# This stage is discarded after the build — only the compiled output
# is copied into the runtime stage.
#
# Language-specific examples (uncomment the one you need):
#
# --- Rust ---
#   RUN apk add --no-cache rust pkgconf build-base
#   COPY Cargo.toml Cargo.lock ./
#   COPY src/ ./src/
#   RUN cargo build --release
#   # Output: /build/target/release/anvomidaviser
#
# --- Elixir ---
#   RUN apk add --no-cache erl27-elixir-1.18 erlang-27 erlang-27-dev git build-base
#   COPY mix.exs mix.lock ./
#   COPY lib/ ./lib/
#   COPY config/ ./config/
#   ENV MIX_ENV=prod
#   RUN mix local.hex --force && mix local.rebar --force && \
#       mix deps.get --only prod && mix compile && mix release
#   # Output: /build/_build/prod/rel/anvomidaviser/
#
# --- Zig ---
#   RUN apk add --no-cache zig build-base
#   COPY build.zig build.zig.zon ./
#   COPY src/ ./src/
#   RUN zig build -Doptimize=ReleaseFast
#   # Output: /build/zig-out/bin/anvomidaviser
#
FROM cgr.dev/chainguard/wolfi-base:latest AS builder

# TODO: Install your language toolchain
RUN apk add --no-cache build-base

WORKDIR /build

# TODO: Copy source files and build
COPY . .
# RUN <your-build-command>

# ============================================================================
# Stage 2: Runtime
# ============================================================================
#
# Minimal production image. Only the compiled binary/release and runtime
# dependencies are included. No compilers, no source code, no build tools.
#
FROM cgr.dev/chainguard/wolfi-base:latest

# OCI image labels (compatible with cerro-torre .ctp bundle metadata)
LABEL org.opencontainers.image.title="anvomidaviser" \
      org.opencontainers.image.description="Convert ISU notation to formal figure skating programs via Anvomidav" \
      org.opencontainers.image.url="https://github.com/hyperpolymath/anvomidaviser" \
      org.opencontainers.image.source="https://github.com/hyperpolymath/anvomidaviser" \
      org.opencontainers.image.vendor="hyperpolymath" \
      org.opencontainers.image.licenses="PMPL-1.0-or-later" \
      org.opencontainers.image.authors="Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>" \
      dev.cerrotorre.manifest="container/manifest.toml" \
      dev.cerrotorre.gatekeeper="container/.gatekeeper.yaml" \
      dev.stapeln.compose="container/compose.toml"

# Install minimal runtime dependencies.
# Adjust this list for your application:
#   - ca-certificates: TLS root certificates
#   - curl: health check probe
#   - libstdc++: C++ standard library (if needed by native deps)
#   - ncurses: terminal UI (if needed, e.g. Elixir IEx)
RUN apk add --no-cache ca-certificates curl

# Create non-root user for the application.
# Running as root inside containers is a security anti-pattern.
RUN addgroup -S appuser && adduser -S appuser -G appuser

WORKDIR /app

# TODO: Copy compiled binary/release from builder stage.
# Examples:
#   COPY --from=builder /build/target/release/anvomidaviser /app/anvomidaviser
#   COPY --from=builder /build/_build/prod/rel/anvomidaviser /app/release/
#   COPY --from=builder /build/zig-out/bin/anvomidaviser /app/anvomidaviser

# Copy entrypoint script
COPY container/entrypoint.sh /app/entrypoint.sh
RUN chmod +x /app/entrypoint.sh

# Copy stapeln integration files (svalinn gatekeeper policy, cerro-torre manifest)
COPY container/.gatekeeper.yaml /etc/svalinn/gatekeeper.yaml
COPY container/manifest.toml /app/manifest.toml

# Create data directory for persistent storage (mountable volume)
RUN mkdir -p /data && chown appuser:appuser /data

# Set ownership of the application directory
RUN chown -R appuser:appuser /app

# Environment variables — customise for your application
ENV APP_HOST=[::]
ENV APP_PORT=8080
ENV APP_LOG_FORMAT=json
ENV APP_DATA_DIR=/data

# Declare /data as a volume for persistent storage
VOLUME ["/data"]

# Run as non-root
USER appuser

# Expose the application port
EXPOSE 8080

# Health check — the application must respond 2xx at /health
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD curl -sf http://localhost:${APP_PORT}/health || exit 1

ENTRYPOINT ["/app/entrypoint.sh"]
