Dockerfile

# MemoryOS Gateway Dockerfile
FROM rust:slim-bookworm AS chef

RUN apt-get update && apt-get install -y \
    pkg-config \
    libssl-dev \
    curl \
    && rm -rf /var/lib/apt/lists/* \
    && cargo install cargo-chef --locked

WORKDIR /build

# Phase 1: Generate dependency recipe (changes only when Cargo.toml/lock change)
FROM chef AS planner
COPY Cargo.toml Cargo.lock ./
COPY crates ./crates
RUN cargo chef prepare --recipe-path recipe.json

# Phase 2: Build dependencies (cached unless recipe changes)
FROM chef AS builder
COPY --from=planner /build/recipe.json recipe.json
RUN cargo chef cook --release --recipe-path recipe.json

# Phase 3: Build application (only recompiles your code)
COPY Cargo.toml Cargo.lock ./
COPY crates ./crates
RUN cargo build --release --bin memoryos-gateway

# Runtime image
FROM debian:bookworm-slim

# Install runtime dependencies
RUN apt-get update && apt-get install -y \
    ca-certificates \
    libssl3 \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Create non-root user (DevOps red line: never run as root in containers)
RUN groupadd -r memoryos && useradd -r -g memoryos -d /app -s /sbin/nologin memoryos

WORKDIR /app

COPY --from=builder /build/target/release/memoryos-gateway /app/
RUN chown -R memoryos:memoryos /app

USER memoryos

EXPOSE 8080

HEALTHCHECK --interval=15s --timeout=5s --retries=3 \
    CMD curl -f http://localhost:8080/health || exit 1

CMD ["./memoryos-gateway"]