Dockerfile

# Multi-stage Dockerfile for SecureFabric Node
# Stage 1: Build the binary
FROM rust:1.84-slim AS builder

# Install build dependencies
RUN apt-get update && apt-get install -y \
    pkg-config \
    libssl-dev \
    protobuf-compiler \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /build

# Copy manifests and lock file
COPY Cargo.toml Cargo.lock ./
COPY core/Cargo.toml ./core/
COPY node/Cargo.toml ./node/
COPY tests-common/Cargo.toml ./tests-common/
COPY proto ./proto

# Copy source code
COPY core/src ./core/src
COPY node/src ./node/src
COPY node/build.rs ./node/
COPY tests-common/src ./tests-common/src

# Build release binary with xchacha20 feature (xchacha20 is default in securefabric-core)
RUN cargo build --release -p securefabric-node 

# Stage 2: Runtime image
FROM debian:bookworm-slim

# Install runtime dependencies
RUN apt-get update && apt-get install -y \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Create non-root user
RUN useradd -m -u 1000 -s /bin/bash securefabric

# Copy binary from builder
COPY --from=builder /build/target/release/securefabric-node /usr/local/bin/

# Create directories
RUN mkdir -p /data /etc/securefabric/tls && \
    chown -R securefabric:securefabric /data /etc/securefabric

# Switch to non-root user
USER securefabric
WORKDIR /home/securefabric

# Expose ports
# 50051: gRPC (mTLS)
# 9090: Metrics (HTTP)
EXPOSE 50051 9090

# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD curl -f http://localhost:9090/metrics || exit 1

# Default environment variables
ENV SF_GRPC=0.0.0.0:50051 \
    SF_METRICS=0.0.0.0:9090 \
    SF_WAL_DIR=/data \
    SF_BROADCAST_MODE=ciphertext \
    SF_BACKPRESSURE_POLICY=reject \
    SF_SUB_QUEUE=1024 \
    SF_MAX_MSG_BYTES=1048576 \
    SF_WAL_FSYNC=batch

ENTRYPOINT ["securefabric-node"]