# ---- Build stage ----------------------------------------------------------
# Pin the registry explicitly to avoid internal mirror DNS issues during build.
FROM docker.io/library/node:20-alpine AS builder

WORKDIR /app

COPY package*.json tsconfig.json ./
RUN npm install --no-audit --no-fund

COPY src/ ./src/
RUN npm run build

# ---- Runtime stage --------------------------------------------------------
FROM docker.io/library/node:20-alpine

WORKDIR /app

# Install only production dependencies
COPY package*.json ./
RUN npm install --omit=dev --no-audit --no-fund && npm cache clean --force

# Copy compiled output and entry point
COPY --from=builder /app/dist ./dist
COPY server.js ./

# Run as non-root user for security
RUN addgroup -S app && adduser -S app -G app
USER app

EXPOSE 3012

CMD ["node", "server.js"]\n