# multi-stage: compile inside x86_64 linux (glibc — matches the deploy
# target; zstd/xxhash are vendored so no system dev packages are needed)
FROM --platform=linux/amd64 debian:bookworm-slim AS builder
RUN apt-get update && apt-get install -y --no-install-recommends curl xz-utils ca-certificates git && rm -rf /var/lib/apt/lists/*
RUN curl -fSL https://ziglang.org/download/0.17.0/zig-x86_64-linux-0.17.0.tar.xz | tar xJ -C /opt
ENV PATH=/opt/zig-x86_64-linux-0.17.0:$PATH
WORKDIR /build

# fetch dependencies first (cacheable — only changes with build.zig.zon)
COPY build.zig build.zig.zon ./
RUN zig build --fetch

COPY .git/ .git/
COPY src/ src/
RUN zig build -Doptimize=ReleaseSafe -Dcpu=baseline -Dtarget=x86_64-linux-gnu

FROM --platform=linux/amd64 debian:bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates libcurl4 && rm -rf /var/lib/apt/lists/*
COPY --from=builder /build/zig-out/bin/stream /usr/local/bin/stream
# glibc arena fragmentation guard (docs/lessons-from-zlay.md #8);
# helm values set it too — defense in depth
ENV MALLOC_ARENA_MAX=4
EXPOSE 6008
VOLUME /data
ENTRYPOINT ["/usr/local/bin/stream"]