# syntax=docker/dockerfile:1
# Release-only image assembly.
#
# The public release workflow supplies the already-built, native Linux musl
# artifacts from release-artifacts.yml. Keeping compilation out of this image
# build makes the container use the same exact runtime bytes as the archives
# and avoids a second, emulated Rust build on the publication path.

FROM debian:bookworm-slim

RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    libdbus-1-3 \
    && rm -rf /var/lib/apt/lists/*

RUN groupadd --gid 1000 codewhale \
    && useradd --create-home --shell /bin/bash --uid 1000 --gid 1000 codewhale \
    && install -d -m 0700 -o codewhale -g codewhale /home/codewhale/.codewhale \
    && install -d -m 0700 -o codewhale -g codewhale /home/codewhale/.deepseek

COPY --chmod=0755 --chown=codewhale:codewhale bin/codewhale /usr/local/bin/codewhale
COPY --chmod=0755 --chown=codewhale:codewhale bin/codew /usr/local/bin/codew

USER codewhale
WORKDIR /home/codewhale
ENTRYPOINT ["codewhale"]
CMD []