# jac-serve — the HTTP surface over the jacquard engine.
#
# Base images come from AWS Public ECR's mirror of the Docker Official Images
# rather than Docker Hub: `az acr build` runs from Azure IPs, where anonymous
# Docker Hub pulls hit Cloudflare challenges and rate limits. Same reasoning as
# rust-blog's Dockerfile.
#
# What this image deliberately does NOT carry:
# - whisper.cpp. Local transcription is a workstation feature; shipping a
# 150MB model into a container that scales to zero would pay for it on
# every cold start. WHISPER_MODEL simply stays unset and the surface
# answers 503, which the browser already falls back from.
# - Any repository content. Repos arrive at boot via JAC_HOST_DIR, or not at
# all.
FROM public.ecr.aws/docker/library/rust:1-bookworm AS builder
WORKDIR /build
# Manifests first so a dependency-only layer can cache across source edits.
COPY Cargo.toml Cargo.lock ./
COPY crates ./crates
COPY xtask ./xtask
RUN cargo build --release --bin jac-serve
FROM public.ecr.aws/docker/library/debian:bookworm-slim
RUN apt-get update \
&& apt-get install -y --no-install-recommends ca-certificates \
&& rm -rf /var/lib/apt/lists/*
COPY --from=builder /build/target/release/jac-serve /usr/local/bin/jac-serve
# Repos that live on disk. Baked in by CI when there is a shelf to serve;
# empty otherwise, which is a valid state — the surface just hosts nothing.
RUN mkdir -p /srv/jack
ENV JAC_HOST_DIR=/srv/jack
# Container Apps routes to whatever the app declares; 8787 is what the repo
# uses everywhere else, so it stays 8787 rather than becoming a second number
# to remember.
ENV JAC_SERVE_PORT=8787
EXPOSE 8787
# Runs as a non-root user: this process reads a repo directory and talks HTTP,
# and needs nothing that root would grant it.
RUN useradd --system --create-home --uid 10001 jacquard \
&& chown -R jacquard:jacquard /srv/jack
USER jacquard
CMD ["jac-serve"]