@startuml
title After: Runtime image is assembled without apt
skinparam backgroundColor #FFFFFF
skinparam componentStyle rectangle
skinparam defaultFontName Consolas
skinparam defaultFontColor #000000
skinparam shadowing false

package "Builder stage\nrust:1.93.1-bookworm" #E8FFF0 {
  component "native build toolchain\nfrom base image" as toolchain
  component "cargo build --release\n--bin server --features server" as cargoBuild
}

package "Runtime dependency stage" #FFF8DC {
  component "find libssl.so.3" as findSsl
  component "find libcrypto.so.3" as findCrypto
  component "copy /etc/ssl + CA bundle" as copyCa
}

package "Runtime stage\ndebian:bookworm-slim" #E8F1FF {
  component "COPY runtime deps\nfrom runtime-deps stage" as copyDeps
  component "COPY /app/server" as copyServer
  component "/app/server" as server
}

toolchain --> cargoBuild
cargoBuild --> findSsl
cargoBuild --> findCrypto
cargoBuild --> copyCa
findSsl --> copyDeps
findCrypto --> copyDeps
copyCa --> copyDeps
copyDeps --> server : OpenSSL + CA runtime deps
cargoBuild --> copyServer
copyServer --> server

note right of copyDeps
The final runtime stage no longer
calls apt-get, so Debian mirror
signature flakiness cannot break it.
end note
@enduml
