Containerfile.hardened

# ── Build stage ───────────────────────────────────────────────────────────────
FROM registry.access.redhat.com/hi/rust:latest-builder@sha256:3b4a613b671cc37beca7a5629cfbf1a16997d7d9d40e86927f04d5942b567346 AS builder

RUN dnf install -y openssl-devel pkgconfig make gcc awk && dnf clean all

WORKDIR /build

# Cache dependency compilation separately from source changes.
COPY Cargo.toml Cargo.lock ./
COPY crates/core/Cargo.toml        crates/core/Cargo.toml
COPY crates/config/Cargo.toml      crates/config/Cargo.toml
COPY crates/adapters/Cargo.toml    crates/adapters/Cargo.toml
COPY crates/web/Cargo.toml         crates/web/Cargo.toml
COPY crates/examples/Cargo.toml    crates/examples/Cargo.toml
COPY server/Cargo.toml             server/Cargo.toml
COPY cli/Cargo.toml                cli/Cargo.toml
COPY patches/ patches/

# Stub out every lib/main so cargo can resolve and compile deps.
RUN for crate in crates/core crates/config crates/adapters crates/web; do \
    mkdir -p $crate/src && echo "pub fn _stub() {}" > $crate/src/lib.rs; \
    done && \
    mkdir -p crates/examples/src && echo "pub fn _stub() {}" > crates/examples/src/lib.rs && \
    mkdir -p server/src && echo "fn main() {}" > server/src/main.rs && \
    mkdir -p cli/src    && echo "fn main() {}" > cli/src/main.rs

RUN cargo build --release -p batlehub-server -p batlehub-cli 2>/dev/null; exit 0

# Now copy real source and rebuild (only changed crates recompile).
COPY crates/ crates/
COPY server/ server/
COPY cli/    cli/

# Touch lib/main files so cargo detects the change.
RUN touch crates/*/src/lib.rs server/src/main.rs cli/src/main.rs

RUN cargo build --release -p batlehub-server -p batlehub-cli

# ── Frontend build stage ───────────────────────────────────────────────────────
FROM registry.access.redhat.com/hi/nodejs:latest-builder@sha256:8be7c653f1049270af4f01fbc995db199356ed2d0801bd03629ab8598f40baf9 AS ui-builder

USER root
WORKDIR /ui
# Corepack is no longer distributed with Node (removed in Node 25), so pnpm is
# installed explicitly. Keep this version in sync with the `packageManager`
# field in ui/package.json.
RUN npm install -g pnpm@11.15.1
COPY ui/package.json ui/pnpm-lock.yaml ui/pnpm-workspace.yaml ./
# --frozen-lockfile is the `npm ci` equivalent: it fails rather than silently
# resolving something the committed lockfile does not describe.
RUN pnpm install --frozen-lockfile

COPY ui/ ./

# Generate the OpenAPI spec from the just-built binary and then the TS client.
COPY --from=builder /build/target/release/batlehub /usr/local/bin/batlehub
COPY config.example.toml /etc/batlehub/config.toml
RUN batlehub --config /etc/batlehub/config.toml dump-spec > openapi.json && \
    pnpm run generate && \
    pnpm run build

# ── Runtime image ─────────────────────────────────────────────────────────────
FROM registry.access.redhat.com/hi/core-runtime:latest@sha256:ff4c6de2e0bfc0d1cd771e8fad858ccbeff5dec01c55d18124f56653ee93eb79 AS runtime

COPY --from=builder   /build/target/release/batlehub     /usr/local/bin/batlehub
COPY --from=builder   /build/target/release/batlehub-cli /usr/local/bin/batlehub-cli
COPY --from=ui-builder /ui/dist                          /app/ui/dist

EXPOSE 8080

ENTRYPOINT ["batlehub"]
CMD ["--config", "/etc/batlehub/config.toml"]