# Tenuo Authorizer Docker Image
#
# This is a minimal distroless image for the data plane authorizer.
# Designed to be small (~15MB) and fast for sidecar deployment.
#
# Note: No HEALTHCHECK instruction - distroless has no shell/curl.
# For Kubernetes, use HTTP probes:
#   livenessProbe:
#     httpGet:
#       path: /health
#       port: 8080
#   readinessProbe:
#     httpGet:
#       path: /ready
#       port: 8080
#
# Available health endpoints (no auth required):
#   GET /health  - Returns {"status": "healthy"}
#   GET /healthz - Same (K8s convention)
#   GET /ready   - Same (readiness probe)
#
# Build:
#   docker build -f deploy/docker/Dockerfile.authorizer -t tenuo/authorizer:latest .
#
# Run:
#   docker run -p 9090:9090 -e TENUO_TRUSTED_KEYS=<hex> tenuo/authorizer:latest serve

# ============================================================================
# Build stage
# ============================================================================
# ============================================================================
# Chef stage - Install cargo-chef
# ============================================================================
FROM rust:1.88-bookworm as chef
WORKDIR /app
RUN cargo install cargo-chef

# ============================================================================
# Planner stage - Compute recipe
# ============================================================================
FROM chef as planner
COPY . .
RUN cargo chef prepare --recipe-path recipe.json

# ============================================================================
# Builder stage - Build dependencies and app
# ============================================================================
FROM chef as builder
COPY --from=planner /app/recipe.json recipe.json
# Build dependencies - this is cached if recipe.json doesn't change
RUN cargo chef cook --release --recipe-path recipe.json --features "data-plane,server"

# Build application
COPY . .
RUN cargo build --release --bin tenuo-authorizer --features "data-plane,server"

# ============================================================================
# Runtime stage - minimal image
# ============================================================================
FROM gcr.io/distroless/cc-debian12

# Copy binary
COPY --from=builder /app/target/release/tenuo-authorizer /tenuo-authorizer

# Run as non-root
USER 1000

# Entry point
ENTRYPOINT ["/tenuo-authorizer"]

