# Build stage
FROM rust:1-bookworm AS builder
WORKDIR /app
# Copy manifests and source
COPY Cargo.toml Cargo.lock* ./
COPY config.yaml config.yaml
COPY table_id_map.yaml table_id_map.yaml
COPY openapi.yaml openapi.yaml
COPY openapi-wss.yaml openapi-wss.yaml
COPY config ./config
COPY src ./src
COPY generated ./generated
COPY sql ./sql
# Build release binary
RUN cargo build --release
# Runtime stage (minimal, non-root, hardened)
FROM gcr.io/distroless/cc-debian12:nonroot
WORKDIR /app
COPY --from=builder /app/target/release/athena_rs /app/athena_rs
COPY config.yaml ./config.yaml
COPY table_id_map.yaml table_id_map.yaml
COPY config ./config
ENV RUST_LOG=info
EXPOSE 4052
USER nonroot
ENTRYPOINT ["/app/athena_rs"]
CMD ["--api-only", "--port", "4052"]