FROM node:24-slim AS builder

WORKDIR /app

COPY package.json package-lock.json* ./
RUN npm ci

COPY . .
RUN npm run build

# Run stage
FROM node:24-slim AS runner

# Run as non-root user (node user exists in official image)
USER node
WORKDIR /app

ENV HOST=0.0.0.0
ENV PORT=3000

# Copy app as node user (builder stage ran as root)
COPY --from=builder --chown=node:node /app/.output ./.output

EXPOSE 3000

CMD ["node", ".output/server/index.mjs"]