clearcutt-cc15 : distroless

# Stage 1: Build the C/C++ application inside GCC dev builder
FROM ghcr.io/northcutted/clearcutt/clearcutt-cc15:v0.6.4-dev AS builder
WORKDIR /app

COPY CMakeLists.txt .
COPY src ./src
RUN cmake . && make

# Stage 2: Hardened runner stage (distroless or slim JRE/runtime)
FROM ghcr.io/northcutted/clearcutt/clearcutt-cc15:v0.6.4-distroless
WORKDIR /app

# Copy compiled executable
COPY --from=builder /app/bin/myapp ./myapp

# Run C/C++ application as secure non-root operator
USER 10001:10001
CMD ["./myapp"]

# Run an interactive local dev shell with the exact same remediated GCC environment:
$ nix shell github:northcutted/clearcutt-images/v0.6.4#clearcuttCc15-native

# Or declare inside your local flake.nix:
{
  inputs.clearcutt.url = "github:northcutted/clearcutt-images/v0.6.4";
  outputs = { self, nixpkgs, clearcutt }: {
    devShells.x86_64-linux.default = let
      pkgs = import nixpkgs {
        system = "x86_64-linux";
        overlays = [ clearcutt.overlays.default ];
      };
    in pkgs.mkShell {
      buildInputs = [ pkgs.clearcuttCc15 ];
    };
  };
}

# Build a C/C++ custom image declaratively by compiling via Nix and packaging
pkgs.dockerTools.buildImage {
  name = "custom-cpp-daemon";
  tag = "latest";
  
  # Layer on top of ClearCutt's base
  fromImage = clearcutt-base-image;

  copyToRoot = pkgs.buildEnv {
    name = "image-root";
    paths = [
      pkgs.zlib             # Layer in extra dynamically-linked libraries
      cpp-application       # Pure C/C++ binary compiled declaratively via Nix
    ];
    pathsToLink = [ "/bin" "/lib" ];
  };

  config = {
    Cmd = [ "/bin/daemon" ];
    User = "10001:10001";
  };
}