Dockerfile.distroless

# Multi-stage Dockerfile for redvector - Ultra-minimal distroless version
# Using Debian for build, distroless for ultra-minimal runtime (no shell, no package manager)
# Stage 1: Build dependencies
FROM rust:1.85-slim AS builder

# Install build dependencies
RUN apt-get update && apt-get install -y \
    pkg-config \
    libssl-dev \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Create app directory
WORKDIR /build

# Copy dependency manifests first for better caching
COPY Cargo.toml ./
COPY command/Cargo.toml ./command/
COPY config/Cargo.toml ./config/
COPY database/Cargo.toml ./database/
COPY networking/Cargo.toml ./networking/
COPY parser/Cargo.toml ./parser/
COPY response/Cargo.toml ./response/
COPY persistence/Cargo.toml ./persistence/
COPY logger/Cargo.toml ./logger/
COPY util/Cargo.toml ./util/
COPY compat/Cargo.toml ./compat/
COPY Cargo.lock* ./

# Create dummy source files to build dependencies
RUN mkdir -p src command/src config/src database/src networking/src parser/src response/src persistence/src logger/src util/src compat/src && \
    echo "fn main() {}" > src/main.rs && \
    echo "pub fn dummy() {}" > command/src/lib.rs && \
    echo "pub fn dummy() {}" > config/src/lib.rs && \
    echo "pub fn dummy() {}" > database/src/lib.rs && \
    echo "pub fn dummy() {}" > networking/src/lib.rs && \
    echo "pub fn dummy() {}" > parser/src/lib.rs && \
    echo "pub fn dummy() {}" > response/src/lib.rs && \
    echo "pub fn dummy() {}" > persistence/src/lib.rs && \
    echo "pub fn dummy() {}" > logger/src/lib.rs && \
    echo "pub fn dummy() {}" > util/src/lib.rs && \
    echo "pub fn dummy() {}" > compat/src/lib.rs

# Build dependencies (this layer will be cached)
RUN cargo build --release 2>&1 | grep -v "^   Compiling" || true

# Copy actual source code
COPY . .

# Build the actual application with optimizations
RUN cargo build --release && \
    strip /build/target/release/redvector

# Stage 2: Distroless runtime (ultra-minimal, secure, ~20MB)
FROM gcr.io/distroless/cc-debian12:nonroot

# Copy CA certificates
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/

# Copy the binary from builder
COPY --from=builder /build/target/release/redvector /usr/local/bin/redvector

# Set working directory
WORKDIR /data

# Expose Redis default port
EXPOSE 6379

# Note: Health checks require a shell, so distroless doesn't support them
# Use external health checks or monitoring instead

# Use distroless nonroot user (uid 65532)
USER nonroot:nonroot

# Default command
ENTRYPOINT ["/usr/local/bin/redvector"]

# Default arguments (can be overridden)
CMD []