FROM rust:1.94-bookworm AS builder
# Statically linked musl build. Override for other architectures, e.g. --build-arg RUST_TARGET=aarch64-unknown-linux-musl
ARG RUST_TARGET=x86_64-unknown-linux-musl
RUN rustup target add ${RUST_TARGET}
WORKDIR /build

# Build dependencies against stub sources so this layer is only invalidated by Cargo.toml/Cargo.lock changes.
COPY Cargo.toml Cargo.lock ./
RUN mkdir -p src/bin \
    && touch src/lib.rs \
    && echo 'fn main() {}' > src/bin/rust-bfdd.rs \
    && cargo build --release --locked --target ${RUST_TARGET} --bin rust-bfdd \
    && rm -rf src

COPY src ./src
# COPY keeps the host mtimes, which may predate the stub build; force cargo to rebuild the crate itself.
RUN touch src/lib.rs src/bin/rust-bfdd.rs \
    && cargo build --release --locked --target ${RUST_TARGET} --bin rust-bfdd \
    && mkdir -p /rootfs/etc/rust-bfd/hooks.d \
    && cp target/${RUST_TARGET}/release/rust-bfdd /rootfs/rust-bfdd

FROM scratch
COPY --from=builder /rootfs/etc /etc
COPY --from=builder /rootfs/rust-bfdd /usr/local/bin/rust-bfdd
# No /etc/passwd in scratch, so use a numeric unprivileged user
USER 10001:10001
EXPOSE 3784/udp
ENTRYPOINT ["/usr/local/bin/rust-bfdd"]