···11+# Multi-stage build for slingshot.
22+#
33+# The build context must be the workspace ROOT (microcosm-rs/)
44+FROM rust:1.96-bookworm AS builder
55+66+# aws-lc-sys (pulled in via rustls' default aws-lc-rs provider) builds a C
77+# library with cmake and runs bindgen (needs libclang); reqwest's default-tls
88+# and jetstream's tungstenite native-tls need OpenSSL headers.
99+RUN apt-get update && apt-get install -y --no-install-recommends \
1010+ clang \
1111+ libclang-dev \
1212+ build-essential \
1313+ cmake \
1414+ libssl-dev \
1515+ pkg-config \
1616+ && rm -rf /var/lib/apt/lists/*
1717+1818+WORKDIR /app
1919+COPY . .
2020+2121+# Cache the cargo registry and target dir across builds. Because the target dir
2222+# lives in a cache mount (not the layer), copy the finished binary out in the
2323+# same RUN so it survives into the image.
2424+RUN --mount=type=cache,target=/usr/local/cargo/registry \
2525+ --mount=type=cache,target=/app/target \
2626+ cargo build --release -p slingshot \
2727+ && cp target/release/slingshot /usr/local/bin/slingshot
2828+2929+FROM debian:12.14-slim AS runtime
3030+3131+# ca-certificates for TLS to jetstream/plc; libssl3 for native-tls at runtime.
3232+RUN apt-get update && apt-get install -y --no-install-recommends \
3333+ ca-certificates \
3434+ libssl3 \
3535+ && rm -rf /var/lib/apt/lists/*
3636+3737+COPY --from=builder /usr/local/bin/slingshot /usr/local/bin/slingshot
3838+3939+# slingshot serves ./static/index.html relative to its working directory.
4040+WORKDIR /app
4141+COPY --from=builder /app/slingshot/static ./static
4242+4343+RUN mkdir -p /data
4444+VOLUME ["/data"]
4545+4646+ENTRYPOINT ["slingshot"]
4747+CMD ["--help"]