# YMZ-API-BROKER — zero-npm-dependency Node 22 service.
#
# The base image is digest-pinned in infra/compose/api-vps/IMAGE.lock and the
# compose file builds this context to the local tag `ymz-api-broker:local`.
# No npm install happens: the broker only uses node stdlib + a local, audited
# PostgreSQL wire-protocol client (lib/pgwire.js).
FROM node:22-alpine@sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914

ENV NODE_ENV=production \
    PORT=4191

WORKDIR /app
COPY lib/ /app/lib/
COPY index.js /app/index.js

# The build context may be synced with conservative permissions; the image runs
# as the unprivileged `node` user, so make the app tree readable.
RUN chmod 755 /app/index.js && chmod -R a+rX /app/lib

# Run unprivileged; the port is >1024 and all state lives in Postgres.
USER node

EXPOSE 4191
CMD ["node", "/app/index.js"]
