# 基础镜像
FROM denoland/deno:2.0

# 设置工作目录
WORKDIR /app

# 复制依赖文件（利用缓存层）
COPY deno.json .
COPY deno.lock .

# 缓存依赖
RUN deno install

# 复制源代码
COPY . .

# 暴露端口
EXPOSE 8000

# 启动命令
CMD ["deno", "run", "--allow-net", "--allow-env", "main.ts"]

# ====== 构建阶段 ======
FROM denoland/deno:2.0 AS builder

WORKDIR /app
COPY deno.json deno.lock ./
COPY src/ ./src/

# 编译为独立可执行文件
RUN deno compile \
  --allow-net \
  --allow-env \
  --allow-read \
  --output server \
  src/main.ts

# ====== 生产阶段 ======
FROM debian:bookworm-slim AS production

# 安装 ca-certificates（HTTPS 请求需要）
RUN apt-get update && \
    apt-get install -y --no-install-recommends ca-certificates && \
    rm -rf /var/lib/apt/lists/*

WORKDIR /app

# 从构建阶段复制编译后的可执行文件
COPY --from=builder /app/server .

# 设置非 root 用户
RUN useradd -r -s /bin/false deno
USER deno

EXPOSE 8000

CMD ["./server"]

FROM denoland/deno:2.0

WORKDIR /app

# 第 1 层：依赖文件（变化最少）
COPY deno.json deno.lock ./

# 第 2 层：缓存依赖（只在依赖变化时重建）
RUN deno install --allow-scripts

# 第 3 层：源代码（变化最频繁）
COPY . .

CMD ["deno", "run", "--allow-net", "main.ts"]

# 指定缓存目录
ENV DENO_DIR=/deno-dir
RUN mkdir -p $DENO_DIR

# 在缓存层中预下载依赖
COPY deno.json deno.lock ./
RUN deno install

# docker-compose.yml
version: "3.8"

services:
  app:
    build: .
    ports:
      - "8000:8000"
    environment:
      - DATABASE_URL=postgres://user:password@db:5432/mydb
      - NODE_ENV=production
    depends_on:
      - db
      - redis
    restart: unless-stopped

  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: user
      POSTGRES_PASSWORD: password
      POSTGRES_DB: mydb
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - "5432:5432"

  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"

volumes:
  postgres_data:

FROM denoland/deno:2.0 AS builder

WORKDIR /app
COPY deno.json deno.lock ./
COPY src/ ./src/
COPY static/ ./static/

# 编译
RUN deno compile \
  --allow-net \
  --allow-env \
  --allow-read \
  --output server \
  src/main.ts

# 生产镜像
FROM debian:bookworm-slim

RUN apt-get update && \
    apt-get install -y --no-install-recommends \
      ca-certificates \
      tini && \
    rm -rf /var/lib/apt/lists/*

RUN useradd -r -s /bin/false deno

WORKDIR /app
COPY --from=builder --chown=deno:deno /app/server .
COPY --from=builder --chown=deno:deno /app/static ./static

USER deno
EXPOSE 8000

# 使用 tini 作为 PID 1（正确处理信号）
ENTRYPOINT ["tini", "--"]
CMD ["./server"]

# docker-compose.yml — 安全配置
services:
  app:
    build: .
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M