Dockerfile

# Simple, clean Dockerfile using the latest Rust version
FROM rust:1.85 as builder

WORKDIR /app

# Copy only the manifests first so the dependency layer is cached and reused
# across builds that only change application source (not Cargo.toml/Cargo.lock).
COPY Cargo.toml Cargo.lock ./
RUN cargo fetch

# Now copy the rest of the source and build. Uses the pinned rust:1.85
# toolchain as-is (no rustup update, which would defeat the image pin).
COPY . .
RUN cargo build --release

# Runtime stage
FROM debian:bookworm-slim

# Install only necessary runtime dependencies
RUN apt-get update && \
    apt-get install -y --no-install-recommends ca-certificates curl && \
    rm -rf /var/lib/apt/lists/*

# Create a dedicated non-root user to run the service
RUN groupadd --system bump && \
    useradd --system --gid bump --no-create-home --shell /usr/sbin/nologin bump

# Copy health check script
COPY healthcheck.sh /usr/local/bin/
RUN chmod +x /usr/local/bin/healthcheck.sh

# Define health check
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 CMD ["/usr/local/bin/healthcheck.sh"]

# Copy the binary from builder
COPY --from=builder /app/target/release/bump /usr/local/bin/bump

# Set environment variables.
# Only the two matching parameters that need non-default values are baked in
# here; every other BUMP_* setting (queue size, TTL, weights, cleanup
# interval, earth radius, etc.) is left unset and picked up from its
# per-field default in src/config.rs. All of these, including the two below,
# remain tunable at deploy time via Railway dashboard vars.
ENV RUST_LOG=info
ENV PORT=8080
ENV BUMP_MAX_TIME_DIFF_MS=5000
ENV BUMP_MAX_DISTANCE_METERS=100

# Expose the service port
EXPOSE 8080

# Drop root privileges for the actual running container
USER bump

# Run the service
CMD ["bump"]