clearcutt-dotnet8 : distroless

# Stage 1: Build and publish .NET assembly in SDK dev builder
FROM ghcr.io/northcutted/clearcutt/clearcutt-dotnet8:v0.8.0-dev AS builder
WORKDIR /app

COPY *.csproj ./
RUN dotnet restore

COPY . .
RUN dotnet publish -c Release -o out --no-restore

# Stage 2: Hardened runner stage (distroless or slim ASP.NET runtime)
FROM ghcr.io/northcutted/clearcutt/clearcutt-dotnet8:v0.8.0-distroless
WORKDIR /app

# Copy published assemblies
COPY --from=builder /app/out ./

# Set environment and run as secure non-root operator
USER 10001:10001
ENV ASPNETCORE_URLS=http://+:8080
ENV DOTNET_CLI_TELEMETRY_OPTOUT=1
CMD ["dotnet", "MyDotnetApp.dll"]

# Run an interactive local dev shell with the exact same remediated .NET SDK:
$ nix shell github:northcutted/clearcutt-images/v0.8.0#clearcuttDotnet8-native

# Or declare inside your local flake.nix environment:
{
  inputs.clearcutt.url = "github:northcutted/clearcutt-images/v0.8.0";
  outputs = { self, nixpkgs, clearcutt }: {
    devShells.x86_64-linux.default = let
      pkgs = import nixpkgs {
        system = "x86_64-linux";
        overlays = [ clearcutt.overlays.default ];
      };
    in pkgs.mkShell {
      buildInputs = [ pkgs.clearcuttDotnet8 ];
    };
  };
}

# Layer a .NET runtime release into a custom OCI image declaratively in Nix
pkgs.dockerTools.buildImage {
  name = "custom-dotnet-service";
  tag = "latest";
  
  # Layer on top of ClearCutt's runtime base
  fromImage = clearcutt-base-image;

  copyToRoot = pkgs.buildEnv {
    name = "image-root";
    paths = [
      dotnet-published-package # Monopackage compiled cleanly via Nix env
    ];
    pathsToLink = [ "/bin" ];
  };

  config = {
    Cmd = [ "/bin/dotnet-service" ];
    User = "10001:10001";
  };
}