Dockerfile

# Multi-stage build for Guardian Agent (Rust)
# Optimized for size and security

# Build stage
FROM rust:1.75-slim AS builder

# Install build dependencies
RUN apt-get update && apt-get install -y \
    pkg-config \
    libssl-dev \
    musl-tools \
    && rm -rf /var/lib/apt/lists/*

# Install musl target for static binary
RUN rustup target add x86_64-unknown-linux-musl

WORKDIR /app

# Copy manifests first for better caching
COPY Cargo.toml Cargo.lock ./

# Create a dummy source to build dependencies
RUN mkdir src && echo "fn main() {}" > src/main.rs && \
    echo "pub mod lib;" > src/lib.rs

# Build dependencies (this layer will be cached if Cargo files don't change)
RUN cargo build --release --target x86_64-unknown-linux-musl --features server || true

# Copy actual source code
COPY src ./src
COPY build.rs ./

# Build the actual application
RUN touch src/main.rs && \
    cargo build --release --target x86_64-unknown-linux-musl --features server

# Runtime stage - using distroless for minimal attack surface
FROM gcr.io/distroless/static-debian12:nonroot

# Copy the static binary
COPY --from=builder /app/target/x86_64-unknown-linux-musl/release/guardian-server /usr/local/bin/guardian

# Create log directory (distroless doesn't support RUN, so we'll create it at runtime)
# The binary will create /var/lib/guardian if it doesn't exist

# Expose port
EXPOSE 8080

# Use the nonroot user (distroless provides this)
USER nonroot:nonroot

# Run server
ENTRYPOINT ["/usr/local/bin/guardian"]