FROM node:20-slim

# iptables is required at runtime for egress.js — the Provisioner manipulates the host's
# DOCKER-USER chain directly (see docs/PHASE1_PLATFORM_FOUNDATION.md §5), which requires this
# container to run with --network host --cap-add=NET_ADMIN --cap-add=NET_RAW (see
# docker-compose.dev.yml). This is not a "nice to have" — without those run flags the
# Provisioner cannot enforce egress at all, only fail loudly, which it does.
RUN apt-get update && apt-get install -y --no-install-recommends iptables ca-certificates \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app
COPY package.json ./
RUN npm install --production
COPY src/ ./src/
COPY migrations/ ./migrations/
COPY config/ ./config/

EXPOSE 4100
CMD ["node", "src/server.js"]