clearcutt-corelts : distroless

# Best-practice container compilation pattern using the dev builder image
FROM ghcr.io/northcutted/clearcutt/clearcutt-corelts:v0.5.0-dev AS builder
WORKDIR /app
COPY . .
RUN make build # Compile static system utilities

# Hardened runner stage (distroless or slim OCI runtime)
FROM ghcr.io/northcutted/clearcutt/clearcutt-corelts:v0.5.0-distroless
WORKDIR /app
COPY --from=builder /app/bin/* ./bin/

# Execute binary as secure non-root operator
USER 10001:10001
CMD ["./bin/app"]

# Enter a local development shell with core packages and overlays pre-loaded:
$ nix shell github:northcutted/clearcutt-images/v0.5.0#clearcuttCore

# Or declare in a custom local flake.nix:
{
  inputs.clearcutt.url = "github:northcutted/clearcutt-images/v0.5.0";
  outputs = { self, nixpkgs, clearcutt }: {
    devShells.x86_64-linux.default = let
      pkgs = import nixpkgs {
        system = "x86_64-linux";
        overlays = [ clearcutt.overlays.default ];
      };
    in pkgs.mkShell {
      buildInputs = [ pkgs.clearcuttCore ];
    };
  };
}

# Declare a custom container assembly dynamically layered in Nix
pkgs.dockerTools.buildImage {
  name = "custom-system-daemon";
  tag = "latest";
  
  # Layer on top of ClearCutt's base
  fromImage = clearcutt-base-image;

  copyToRoot = pkgs.buildEnv {
    name = "image-root";
    paths = [
      pkgs.openssl          # Layer in CVE-remediated cryptography libraries
      custom-daemon-binary  # Include custom daemon compiled natively
    ];
    pathsToLink = [ "/bin" "/lib" ];
  };

  config = {
    Cmd = [ "/bin/daemon" ];
    User = "10001:10001";
  };
}