# Build stage: standard node image (root, npm can write). Runtime: Chainguard zero-CVE base.
FROM public.ecr.aws/docker/library/node:20-alpine AS build
WORKDIR /app
COPY package*.json ./
RUN npm install --omit=dev
COPY src/ ./src/
COPY legacy/ ./legacy/

FROM cgr.dev/chainguard/node:latest
WORKDIR /app
COPY --from=build /app ./
EXPOSE 3000
CMD ["src/server.js"]
