FROM rust:1.85-slim AS builder

WORKDIR /usr/src/app

# Cache deps as their own layer.
COPY Cargo.toml Cargo.lock ./
RUN mkdir -p src \
    && echo "fn main() {}" > src/main.rs \
    && cargo build --release \
    && rm -rf src target/release/deps/backend* target/release/backend*

# Now build the real source.
COPY src ./src
RUN cargo build --release

FROM debian:bookworm-slim

RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates curl \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd --system --gid 1000 app \
    && useradd --system --uid 1000 --gid app --home-dir /app app

WORKDIR /app
COPY --from=builder /usr/src/app/target/release/backend /usr/local/bin/backend

USER app:app

EXPOSE 3000
CMD ["backend"]