# ---- Deps stage (production deps only) ----
FROM node:24-alpine3.23 AS deps

RUN apk update && apk upgrade --no-cache

WORKDIR /app

COPY package*.json ./
RUN npm ci --omit=dev && npm cache clean --force && \
    rm -rf node_modules/pg-native node_modules/pg/node_modules/pg-native
# ---- Runtime stage ----
FROM node:24-alpine3.23

RUN apk update && apk upgrade --no-cache

# Remove npm/yarn/corepack from runtime to reduce attack surface
RUN rm -rf \
    /usr/local/lib/node_modules/npm \
    /usr/local/lib/node_modules/corepack \
    /usr/local/bin/npm \
    /usr/local/bin/npx \
    /usr/local/bin/corepack \
    /opt/yarn* \
    /usr/local/bin/yarn \
    /usr/local/bin/yarnpkg

ENV NODE_ENV=production
ENV PORT=4000

WORKDIR /app

COPY --from=deps /app/node_modules ./node_modules
COPY . .

EXPOSE 4000

USER root

CMD ["node", "server.js"]