FROM node:22-alpine AS deps
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --no-audit --no-fund

FROM node:22-alpine AS builder
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
RUN npm run build

FROM node:22-alpine AS runner
WORKDIR /app
ENV NODE_ENV=production \
    PORT=3000 \
    HOSTNAME=0.0.0.0 \
    MONLET_WEB_TIME_ZONE=UTC \
    TZ=UTC
COPY --from=builder /app/.next ./.next
COPY --from=builder /app/public ./public
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/package.json ./package.json
# PH-015: run as the prebuilt non-root `node` user shipped by the base image.
RUN chown -R node:node /app
USER node
EXPOSE 3000
STOPSIGNAL SIGTERM
CMD ["npm", "run", "start"]