FROM rust:1.97.1-alpine3.23 AS build
RUN apk add --no-cache build-base && rustup component add rustfmt
WORKDIR /source
ADD https://codeload.github.com/playit-cloud/playit-agent/tar.gz/refs/tags/v1.0.10 /source.tar.gz
RUN echo '52b431a861c143f3fc78bfce8d7d5862bf865bc88da584cafb62a5fec39c0df4  /source.tar.gz' | sha256sum -c - \
 && tar -xzf /source.tar.gz --strip-components=1
COPY tcp-burst.patch /tmp/tcp-burst.patch
RUN patch -p1 < /tmp/tcp-burst.patch \
 && rustfmt --check --edition 2024 packages/agent_core/src/network/tcp/tcp_settings.rs \
 && cargo test --locked -p playit-agent-core --lib \
 && cargo build --release --locked -p playitd --bin playitd

FROM alpine:3.23
RUN apk add --no-cache ca-certificates
# Build the pinned daemon with a TCP admission budget supporting 128-reader bursts.
COPY --from=build /source/target/release/playitd /usr/local/bin/playitd
COPY --from=build /source/LICENSE.txt /usr/share/licenses/playit/LICENSE.txt
# Official v1.0.10 management CLI, verified against its release digest.
ADD https://github.com/playit-cloud/playit-agent/releases/download/v1.0.10/playit-cli-linux-amd64 /usr/local/bin/playit
RUN echo '6fd54d147ae1d3232b22c1c1f4aa3d13cf16d889e840ca2d3f90b4f50a2e7301  /usr/local/bin/playit' | sha256sum -c - \
 && chmod 755 /usr/local/bin/playitd /usr/local/bin/playit \
 && mkdir -p /data /run/playit && chown -R 65532:65532 /data /run/playit
USER 65532:65532
ENTRYPOINT ["playitd", "--secret-path", "/data/playit.toml", "--socket-path", "/run/playit/playitd.sock", "--platform-docker"]
