# Stage 1: Build
FROM rustlang/rust:nightly-slim AS builder

RUN apt-get update && apt-get install -y pkg-config libssl-dev && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Cache dependencies — only re-runs when Cargo.toml / Cargo.lock change
COPY Cargo.toml Cargo.lock ./
RUN mkdir -p src && echo "fn main() {}" > src/main.rs
RUN cargo build --release && rm -rf src target/release/deps/dns_tui*

# Build the real binary
COPY src ./src
RUN cargo build --release

# Stage 2: Runtime — distroless has no shell, no package manager, no attack surface
# Includes glibc, libgcc, ca-certificates (needed for HTTPS API calls via reqwest+rustls)
# libssl3 is NOT required: reqwest uses rustls (pure-Rust TLS), no OpenSSL at runtime
FROM gcr.io/distroless/cc-debian12

WORKDIR /app

COPY --from=builder /app/target/release/dns-tui /app/dns-tui

USER 1000:1000

# Override with the actual management-api base URL at runtime:
#   docker run -it -e API_URL=http://host:80 <image>
ENV API_URL=http://localhost:80

# TUI requires a real TTY — always run with:  docker run -it  or  docker compose run -it
CMD ["/app/dns-tui"]
