FROM rust:1.88-alpine AS build
RUN apk add --no-cache musl-dev
WORKDIR /app
COPY . .
RUN cargo build --release --locked

FROM alpine:3.20
RUN apk add --no-cache git xz \
    && git config --system --add safe.directory '*'
RUN addgroup -S -g 10001 teak && adduser -S -u 10001 -G teak teak
COPY --from=build /app/target/release/teak /usr/local/bin/teak
USER teak
VOLUME ["/srv/git"]
EXPOSE 3000
ENTRYPOINT ["teak"]
CMD ["--root", "/srv/git"]