# Small, reproducible image — runs the same on your laptop, a VM, or any
# container platform (ECS, Cloud Run, Azure Container Apps, plain Docker on
# a VPS). Node 22 has native fetch, so no extra HTTP client is bundled.
FROM node:22-alpine

WORKDIR /app

# Install deps first so this layer is cached unless package*.json changes.
COPY package.json package-lock.json ./
RUN npm ci --omit=dev

COPY src ./src
COPY public ./public

# Non-root user — standard container-hardening practice.
RUN addgroup -S app && adduser -S app -G app
USER app

ENV PORT=3000
EXPOSE 3000

# Simple liveness/readiness probe your orchestrator can point at.
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
  CMD node -e "fetch('http://localhost:'+(process.env.PORT||3000)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

CMD ["node", "src/index.js"]