FROM rust:1.92-bookworm AS build
WORKDIR /src
RUN apt-get update \
    && apt-get install -y --no-install-recommends clang libclang-dev \
    && rm -rf /var/lib/apt/lists/*
COPY Cargo.toml Cargo.lock ./
RUN mkdir src && printf 'fn main() {}\n' > src/main.rs && cargo build --locked --release
COPY src ./src
RUN touch src/main.rs src/lib.rs && cargo build --locked --release

FROM debian:bookworm-slim
RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates rsync time \
    && rm -rf /var/lib/apt/lists/* \
    && useradd --system --create-home --home-dir /var/lib/panda-rpki panda
COPY --from=build /src/target/release/panda-rpki /usr/local/bin/panda-rpki
COPY LICENSE /usr/share/licenses/panda-rpki/LICENSE
COPY THIRD_PARTY_NOTICES.md /usr/share/licenses/panda-rpki/THIRD_PARTY_NOTICES.md
COPY docs/third-party-licenses.txt /usr/share/licenses/panda-rpki/docs/third-party-licenses.txt
USER panda
ENTRYPOINT ["/usr/local/bin/panda-rpki"]
CMD ["--help"]