# syntax=docker/dockerfile:1.7
# One static binary on a distroless base. Roles are subcommands: serve, check.

FROM rust:1.99-bookworm AS build
WORKDIR /src
RUN rustup target add x86_64-unknown-linux-musl && apt-get update \
    && apt-get install -y --no-install-recommends musl-tools && rm -rf /var/lib/apt/lists/*
COPY . .
RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/src/target \
    cargo build --release --locked --target x86_64-unknown-linux-musl \
    && cp target/x86_64-unknown-linux-musl/release/mcp-ibis /mcp-ibis

FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=build /mcp-ibis /usr/local/bin/mcp-ibis
ENV LISTEN=0.0.0.0:8000 LOG_JSON=true RUST_LOG=info
EXPOSE 8000
USER nonroot
ENTRYPOINT ["/usr/local/bin/mcp-ibis"]
CMD ["serve"]
