# The SDK stays pinned so the warnings-as-errors build is repeatable; bump it
# with each .NET release. The runtime below follows the 10.0 tag instead, so
# every rollout (update-api.sh builds with --pull) gets the newest .NET 10
# security patch. An exact runtime pin had left production on 10.0.9 for five
# security releases (found 2026-11-02).
FROM mcr.microsoft.com/dotnet/sdk:10.0.403-noble AS build
WORKDIR /source

COPY src/ClinicAiGateway/ClinicAiGateway.csproj src/ClinicAiGateway/
RUN dotnet restore src/ClinicAiGateway/ClinicAiGateway.csproj

COPY src/ClinicAiGateway/ src/ClinicAiGateway/
RUN dotnet publish src/ClinicAiGateway/ClinicAiGateway.csproj \
    --configuration Release \
    --no-restore \
    --output /app/publish \
    /p:UseAppHost=false

FROM mcr.microsoft.com/dotnet/aspnet:10.0-noble AS runtime
ENV ASPNETCORE_HTTP_PORTS=8080 \
    DOTNET_EnableDiagnostics=0
WORKDIR /app

RUN apt-get update \
    && apt-get install -y --no-install-recommends curl \
    && rm -rf /var/lib/apt/lists/* \
    && mkdir -p /data \
    && groupadd --system --gid 10002 escai-ai-gateway \
    && chown 1654:10002 /data
COPY --from=build --chown=1654:10002 /app/publish ./

# Preserve the ASP.NET runtime image's stable app UID so existing encrypted
# /data volumes remain writable. The dedicated primary group can read only the
# AI-gateway secret files mounted root:10002 0440.
USER 1654:10002
EXPOSE 8080
ENTRYPOINT ["dotnet", "ClinicAiGateway.dll"]
