FROM oven/bun@sha256:e10577f0db68676a7024391c6e5cb4b879ebd17188ab750cf10024a6d700e5c4 AS build
WORKDIR /app
COPY package.json bun.lock ./
# Infisical is a host-side operator tool; its binary installer is unnecessary in the image.
RUN bun install --frozen-lockfile --ignore-scripts
COPY . .
RUN bun run build

FROM oven/bun@sha256:e10577f0db68676a7024391c6e5cb4b879ebd17188ab750cf10024a6d700e5c4 AS runtime
ARG APP_RELEASE_ID=local
# Production reference imports stream XZ through the OS decoder; no archive extraction shell.
RUN apt-get update && apt-get install -y --no-install-recommends xz-utils && rm -rf /var/lib/apt/lists/*
WORKDIR /app
ENV NODE_ENV=production HOST=0.0.0.0 PORT=3000 APP_RELEASE_ID=$APP_RELEASE_ID
COPY --from=build /app/package.json /app/bun.lock ./
RUN bun install --frozen-lockfile --production
COPY --from=build /app/build ./build
COPY --from=build /app/src/lib ./src/lib
COPY --from=build /app/workers ./workers
COPY --from=build /app/fixtures ./fixtures
RUN mkdir -p /app/data/reference && chown -R bun:bun /app/data
USER bun
EXPOSE 3000
CMD ["bun", "build/index.js"]