# Build stage — compile static binary (Deno 2.8+ for lockfile v5)
ARG DENO_VERSION=2.8.2
FROM denoland/deno:${DENO_VERSION} AS build
WORKDIR /app
COPY deno.json deno.lock* ./
COPY *.ts ./
RUN deno cache main.ts warmup.ts
RUN deno compile --allow-all -o /lime-web-renderer main.ts
RUN deno compile --allow-all -o /warmup-chromium warmup.ts

# Runtime stage — system Chromium for Astral headless (no Deno needed)
FROM debian:bookworm-slim AS runtime
RUN apt-get update && apt-get install -y --no-install-recommends \
	chromium \
	fonts-noto-core \
	ca-certificates \
	&& rm -rf /var/lib/apt/lists/* \
	&& groupadd --system renderer \
	&& useradd --system --gid renderer --create-home renderer
COPY --from=build /lime-web-renderer /usr/local/bin/lime-web-renderer
COPY --from=build /warmup-chromium /usr/local/bin/warmup-chromium
ENV RENDER_RUNTIME=prod \
	CHROMIUM_IN_CONTAINER=1 \
	CHROMIUM_ARGS=--disable-dev-shm-usage,--disable-gpu,--no-first-run,--hide-scrollbars \
	PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium \
	HOME=/home/renderer
USER renderer
RUN /usr/local/bin/warmup-chromium
ENTRYPOINT ["/usr/local/bin/lime-web-renderer"]
