Dockerfile

# Stage 1: Builder
# Use latest stable Rust on Alpine for static linking (musl)
FROM rust:alpine AS builder

WORKDIR /app

# Install build dependencies required for some crates (e.g. openssl-sys via pkg-config if needed, though we try to use rustls)
# musl-dev is required for static compilation
RUN apk add --no-cache musl-dev pkgconfig

# Copy manifests first for dependency caching
COPY Cargo.toml Cargo.lock ./

# Create dummy src/main.rs to build dependencies only
RUN mkdir src && echo "fn main() {}" > src/main.rs

# Build dependencies (release mode)
RUN cargo build --release

# Remove dummy build artifacts
RUN rm -rf src target/release/deps/rush_analytics* target/release/rush-analytics*

# Copy actual source code
COPY src ./src
COPY migrations ./migrations
COPY .sqlx ./.sqlx

# Build the application
# We do NOT strip here because we might want debug symbols for Sentry/Panic logic, 
# but usually for size we rely on profile.release settings (strip=true is set in Cargo.toml)
RUN cargo build --release --bin rush-analytics

# Stage 2: Runtime
FROM alpine:3.19

# Install runtime dependencies
# ca-certificates: Needed for HTTPS (Sentry, etc)
# tzdata: Useful if we need timezone info (though we use UTC usually)
RUN apk add --no-cache ca-certificates tzdata

# Create non-root user 'analytics' (UID 1000) for security
RUN addgroup -g 1000 analytics && \
    adduser -D -u 1000 -G analytics analytics

WORKDIR /app

# Copy the binary from builder
COPY --from=builder /app/target/release/rush-analytics /usr/local/bin/

# Copy migrations (if we run them on startup - though ideally this is a separate job)
COPY --from=builder /app/migrations /app/migrations

# Ensure correct permissions
RUN chown -R analytics:analytics /app

# Switch to non-root user
USER analytics

# Expose API and Metrics ports
EXPOSE 3000
EXPOSE 9090

# Healthcheck
# Since Alpine doesn't have curl by default, we can use wget or install curl. 
# Wget is built-in to BusyBox/Alpine usually.
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1

# Environment variables should be passed at runtime via docker-compose or k8s
ENV PORT=3000

CMD ["rush-analytics"]