# syntax=docker/dockerfile:1.7
FROM rust:1.94-bookworm AS builder
WORKDIR /src
COPY services/entitlement/Cargo.toml services/entitlement/Cargo.toml
COPY services/entitlement/Cargo.lock services/entitlement/Cargo.lock
COPY services/entitlement/src services/entitlement/src
RUN cargo build --manifest-path services/entitlement/Cargo.toml --locked --release

FROM debian:bookworm-slim
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates tini \
 && rm -rf /var/lib/apt/lists/* \
 && useradd --system --uid 10002 --home-dir /nonexistent --shell /usr/sbin/nologin veilcord \
 && install -d -o veilcord -g veilcord -m 0700 /run/veilcord
COPY --from=builder /src/services/entitlement/target/release/veilcord-entitlement /usr/local/bin/veilcord-entitlement
RUN chmod 0555 /usr/local/bin/veilcord-entitlement
USER veilcord
EXPOSE 8090/tcp
HEALTHCHECK --interval=5s --timeout=3s --start-period=5s --retries=3 \
  CMD ["/usr/local/bin/veilcord-entitlement", "--healthcheck"]
ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/veilcord-entitlement"]
