# Minimal runtime image for pre-built Rust service binaries
# Binaries are compiled in CI (with PVC sccache) and passed via build context
# Usage: docker build --build-arg SERVICE=trading_service -f Dockerfile.runtime .

FROM debian:bookworm-slim

RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    libssl3 \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Install grpc_health_probe for Kubernetes health checks
RUN curl -fsSL https://github.com/grpc-ecosystem/grpc-health-probe/releases/download/v0.4.25/grpc_health_probe-linux-amd64 \
    -o /usr/local/bin/grpc_health_probe \
    && chmod +x /usr/local/bin/grpc_health_probe

RUN groupadd -g 1000 foxhunt \
    && useradd -u 1000 -g foxhunt -m -s /bin/false foxhunt

ARG SERVICE
ENV SERVICE=${SERVICE}

WORKDIR /app

COPY ${SERVICE} ./${SERVICE}
RUN chmod +x ./${SERVICE}

USER foxhunt

ENTRYPOINT ["/bin/sh", "-c", "exec /app/${SERVICE}"]