clearcutt-node24 : distroless

# Stage 1: Install dependencies and compile project using dev builder
FROM ghcr.io/northcutted/clearcutt/clearcutt-node24:v0.7.0-dev AS builder
WORKDIR /app

COPY package*.json ./
RUN npm ci

COPY . .
RUN npm run build --if-present

# Stage 2: Hardened runner stage (distroless or slim Node runtime)
FROM ghcr.io/northcutted/clearcutt/clearcutt-node24:v0.7.0-distroless
WORKDIR /app

# Copy built package and production dependencies
COPY --from=builder /app/package*.json ./
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/dist ./dist

# Run as secure non-root operator
USER 10001:10001
ENV NODE_ENV=production
CMD ["node", "dist/index.js"]

# Run an interactive local dev shell with the exact same remediated Node.js engine:
$ nix shell github:northcutted/clearcutt-images/v0.7.0#clearcuttNode24-native

# Or declare inside your local flake.nix environment:
{
  inputs.clearcutt.url = "github:northcutted/clearcutt-images/v0.7.0";
  outputs = { self, nixpkgs, clearcutt }: {
    devShells.x86_64-linux.default = let
      pkgs = import nixpkgs {
        system = "x86_64-linux";
        overlays = [ clearcutt.overlays.default ];
      };
    in pkgs.mkShell {
      buildInputs = [ pkgs.clearcuttNode24 ];
    };
  };
}

# Layer a custom Node app into a secure OCI image declaratively in Nix
pkgs.dockerTools.buildImage {
  name = "custom-node-api";
  tag = "latest";
  
  # Layer on top of ClearCutt's base
  fromImage = clearcutt-base-image;

  copyToRoot = pkgs.buildEnv {
    name = "image-root";
    paths = [
      pkgs.graphicsmagick  # Layer in native dependency declaratively
      node-application     # Include your Node.js distribution env
    ];
    pathsToLink = [ "/bin" "/lib" ];
  };

  config = {
    Cmd = [ "/bin/api" ];
    User = "10001:10001";
  };
}