FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
&& rm -rf /var/lib/apt/lists/* \
&& groupadd -r truss && useradd -r -g truss -s /usr/sbin/nologin truss
COPY --chown=truss:truss truss /truss
RUN chmod 0555 /truss
USER truss
EXPOSE 8080
ENTRYPOINT ["/truss", "serve"]