clearcutt-rust1.95 : distroless

# Stage 1: Build optimized Rust binary in dev cargo compiler builder
FROM ghcr.io/northcutted/clearcutt/clearcutt-rust1.95:v0.10.1-dev AS builder
WORKDIR /app

COPY Cargo.toml Cargo.lock ./
# Create dummy main to cache dependency compilation
RUN mkdir src && echo "fn main() {}" > src/main.rs && cargo build --release

COPY . .
RUN touch src/main.rs && cargo build --release

# Stage 2: Hardened runner stage (distroless or slim OCI runtime)
FROM ghcr.io/northcutted/clearcutt/clearcutt-rust1.95:v0.10.1-distroless
WORKDIR /app

# Copy compiled Rust executable
COPY --from=builder /app/target/release/myapp ./myapp

# Run Rust application as secure non-root operator
USER 10001:10001
CMD ["./myapp"]

# Run an interactive local dev shell with the exact same remediated Rust compiler:
$ nix shell github:northcutted/clearcutt/v0.10.1?dir=core#clearcuttRust195-native

# Or declare inside your local flake.nix:
{
  inputs.clearcutt.url = "github:northcutted/clearcutt/v0.10.1?dir=core";
  outputs = { self, nixpkgs, clearcutt }: {
    devShells.x86_64-linux.default = let
      pkgs = import nixpkgs {
        system = "x86_64-linux";
        overlays = [ clearcutt.overlays.default ];
      };
    in pkgs.mkShell {
      buildInputs = [ pkgs.clearcuttRust195 ];
    };
  };
}

# Build a Rust OCI container declaratively via Nix
pkgs.dockerTools.buildImage {
  name = "custom-rust-app";
  tag = "latest";
  
  # Layer on top of ClearCutt's base
  fromImage = clearcutt-base-image;

  copyToRoot = pkgs.buildEnv {
    name = "image-root";
    paths = [
      rust-compiled-binary   # Highly optimized Rust package compiled cleanly
    ];
    pathsToLink = [ "/bin" ];
  };

  config = {
    Cmd = [ "/bin/rust-app" ];
    User = "10001:10001";
  };
}