FROM rust:bookworm AS builder

WORKDIR /app

# 缓存依赖层
COPY Cargo.toml Cargo.lock ./
RUN mkdir src && echo 'fn main() {}' > src/main.rs
RUN cargo build --release && rm -rf src target/release/blog-backend

# 编译真实代码
COPY src ./src
COPY migrations ./migrations
RUN touch src/main.rs && cargo build --release

FROM debian:bookworm-slim

RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates libssl3 \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

COPY --from=builder /app/target/release/blog-backend /usr/local/bin/blog-backend
COPY --from=builder /app/migrations ./migrations

ENV BIND_ADDR=0.0.0.0:3000
EXPOSE 3000

USER nobody
CMD ["blog-backend"]