# Runtime-only image, for a host that must not compile.
#
# The production box has 3.6 GB of RAM shared with other tenants' services;
# `Dockerfile` pulls a Go toolchain and builds there, which is how deploys
# became something nobody wanted to run. deploy.sh builds the static binary
# on the developer's machine and ships only that. Same runtime layer as
# Dockerfile, on purpose - the two must not drift.
FROM alpine:3.20
RUN apk add --no-cache ca-certificates tzdata && \
    adduser -D -u 10001 behavision
COPY behavision-server /usr/local/bin/behavision-server
USER behavision
EXPOSE 8080
ENTRYPOINT ["/usr/local/bin/behavision-server"]