# Dockerfile — Build jcode-musl using the jerboa21/jerboa base image
#
# Produces a fully static binary with zero runtime dependencies.
# No Chez Scheme or Jerboa installation needed on the target host.
#
# The base image (jerboa21/jerboa) provides stock Chez, musl Chez,
# jerboa libs, and all build dependencies pre-installed.
#
# Usage:
#   docker build -t jcode-builder .
#   docker run --rm jcode-builder > jcode-musl && chmod +x jcode-musl
#
# Or extract via docker cp:
#   docker build -t jcode-builder .
#   id=$(docker create jcode-builder)
#   docker cp $id:/out/jcode-musl ./jcode-musl
#   docker rm $id

FROM jerboa21/jerboa AS builder

ARG CACHE_BUST

# ── Copy jcode source ────────────────────────────────────────────────────────
COPY . /build/mine/jerboa-code

# ── Build jcode-musl ─────────────────────────────────────────────────────────
WORKDIR /build/mine/jerboa-code
RUN JERBOA_HOME=/build/mine/jerboa make linux-local

# ── Verify ───────────────────────────────────────────────────────────────────
RUN echo "--- Binary info ---" && \
    ls -lh jcode-musl && \
    file jcode-musl && \
    echo "--- Hardening checks ---" && \
    { file jcode-musl | grep -qE 'stripped|no section header' && echo "  PASS: stripped" || echo "  WARN: not stripped"; } && \
    echo "--- Path leak check ---" && \
    count=$(strings jcode-musl | grep -c '/home/' || true) && \
    { [ "$count" -gt 0 ] && echo "  WARNING: home paths found ($count)" || echo "  PASS: no home path leaks"; }

# ── Output ───────────────────────────────────────────────────────────────────
FROM ubuntu:24.04
COPY --from=builder /build/mine/jerboa-code/jcode-musl /out/jcode-musl
CMD ["cat", "/out/jcode-musl"]
