# Stage 1: Build
FROM rust:1.85-bookworm as builder
WORKDIR /app
COPY . .
# Build for release to get all those sweet Rust optimizations
RUN cargo build --release

# Stage 2: Run
FROM debian:bookworm-slim
WORKDIR /app

# Install OpenSSL/CA-certs if your app makes outbound HTTPS calls
RUN apt-get update && apt-get install -y ca-certificates && rm -rf /var/lib/lists/*

# Copy the binary from the builder stage
COPY --from=builder /app/target/release/rust-hf-app .

# Create a non-root user for Hugging Face security compliance
RUN useradd -m -u 1000 user
USER user
ENV HOME=/home/user \
    PATH=/home/user/.local/bin:$PATH

# Expose the default HF Spaces port
EXPOSE 7860

CMD ["./rust-hf-app"]