# Runtime image for the Mode A site (docs/phase-2-static-site.md §2.1).
#
# The image contains no toolchain: `make build dist` on the build host produces
# bin/resume-server and dist/, and the image just carries them. That keeps the
# runtime offline and small, and it means the deployed bytes are the bytes that
# were built and tested, not a second compile.
#
# Build context is the repository root:
#
#	make build dist
#	docker build -f deploy/Dockerfile -t ai-resume:local .
#
# Phase 3 (§3.1) owns the release directory, the compose invocation and the
# rollback; this file only describes the process that runs.

FROM gcr.io/distroless/static-debian12:nonroot

COPY bin/resume-server /usr/bin/resume-server
COPY dist/ /srv/site

# 0.0.0.0 is inside the container's own network namespace only. The host
# publishes the port on 127.0.0.1 (see deploy/compose.yml), which is what keeps
# Caddy the only public listener.
ENV RESUME_ADDR=0.0.0.0:8096 \
    RESUME_DIST=/srv/site

EXPOSE 8096
USER nonroot:nonroot
ENTRYPOINT ["/usr/bin/resume-server"]