# multi-stage: compile inside x86_64 linux (glibc — matches the deploy
# target; zstd/xxhash are vendored so no system dev packages are needed)
FROM --platform=linux/amd64 debian:bookworm-slim AS builder
RUN apt-get update && apt-get install -y --no-install-recommends curl xz-utils ca-certificates git \
    && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419~deb12u2 \
    && rm -rf /var/lib/apt/lists/*
RUN curl -fSL https://ziglang.org/download/0.17.0/zig-x86_64-linux-0.17.0.tar.xz | tar xJ -C /opt
ENV PATH=/opt/zig-x86_64-linux-0.17.0:$PATH
WORKDIR /build

# fetch dependencies first (cacheable — only changes with build.zig.zon)
COPY build.zig build.zig.zon ./
RUN zig build --fetch

COPY .git/ .git/
COPY src/ src/
RUN zig build -Doptimize=ReleaseSafe -Dcpu=baseline -Dtarget=x86_64-linux-gnu

FROM --platform=linux/amd64 debian:bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates libcurl4 \
    && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419~deb12u2 \
    && rm -rf /var/lib/apt/lists/*
COPY --from=builder /build/zig-out/bin/stream /usr/local/bin/stream
COPY --from=builder /build/zig-out/bin/stream-tls-probe /usr/local/bin/stream-tls-probe
# glibc arena fragmentation guard (docs/lessons-from-zlay.md #8);
# helm values set it too — defense in depth
ENV MALLOC_ARENA_MAX=4
# an explicit trim threshold also pins glibc's mmap threshold at 128 KiB, so
# compaction's per-block zstd workspaces are mmapped and returned on free
# instead of fragmenting the arenas (zlay runs the same pair)
ENV MALLOC_TRIM_THRESHOLD_=131072
EXPOSE 6008
VOLUME /data
ENTRYPOINT ["/usr/local/bin/stream"]