Add Dockerfile

Multi-stage build producing a slim image with rust-bfdd as the entrypoint. Dependencies are built against stub sources in their own layer so source-only changes do not rebuild them.

Dockerfile

@@ -0,0 +1,23 @@
+FROM rust:1.94-bookworm AS builder
+WORKDIR /build
+
+# Build dependencies against stub sources so this layer is only invalidated by Cargo.toml/Cargo.lock changes.
+COPY Cargo.toml Cargo.lock ./
+RUN mkdir -p src/bin \
+    && touch src/lib.rs \
+    && echo 'fn main() {}' > src/bin/rust-bfdd.rs \
+    && cargo build --release --locked --bin rust-bfdd \
+    && rm -rf src
+
+COPY src ./src
+# COPY keeps the host mtimes, which may predate the stub build; force cargo to rebuild the crate itself.
+RUN touch src/lib.rs src/bin/rust-bfdd.rs \
+    && cargo build --release --locked --bin rust-bfdd
+
+FROM debian:bookworm-slim
+RUN useradd --system --no-create-home --shell /usr/sbin/nologin bfd \
+    && mkdir -p /etc/rust-bfd/hooks.d
+COPY --from=builder /build/target/release/rust-bfdd /usr/local/bin/rust-bfdd
+USER bfd
+EXPOSE 3784/udp
+ENTRYPOINT ["/usr/local/bin/rust-bfdd"]