FROM node:22.22.0-bookworm-slim

ENV NODE_ENV=production
WORKDIR /app
ARG WITNESS_RELEASE_COMMIT=unknown
LABEL org.opencontainers.image.revision=$WITNESS_RELEASE_COMMIT

COPY package.json package-lock.json ./
RUN npm ci --omit=dev --ignore-scripts --no-audit --no-fund \
  && npm cache clean --force

COPY server/manager-ha-lease-expiry-fencer.js server/manager-ha-lease-expiry-fencer.js
COPY server/manager-ha-witness-runtime.js server/manager-ha-witness-runtime.js
COPY server/manager-ha-witness-schema.js server/manager-ha-witness-schema.js
COPY server/manager-ha-witness-service.js server/manager-ha-witness-service.js
COPY server/manager-ha-witness-store.js server/manager-ha-witness-store.js
COPY shared/manager-ha-native-evidence.js shared/manager-ha-native-evidence.js
COPY scripts/run_manager_ha_witness.mjs scripts/run_manager_ha_witness.mjs

# Protected host staging stores sources as 0600. COPY preserves those modes;
# grant the unprivileged container user read/traverse access to image code.
# Runtime secrets are mounted separately and are not part of this build tree.
RUN chmod -R a+rX /app

USER node
RUN node --check scripts/run_manager_ha_witness.mjs
ENTRYPOINT ["node", "scripts/run_manager_ha_witness.mjs"]
CMD ["--config", "/run/kerp-manager-ha-witness/config.json"]
