FROM node:20-bookworm-slim AS runtime
WORKDIR /app
RUN apt-get update && apt-get install -y --no-install-recommends curl \
    && rm -rf /var/lib/apt/lists/* && useradd -r -u 10001 -s /usr/sbin/nologin appuser
COPY package*.json ./
RUN npm install --omit=dev --no-audit --no-fund 2>/dev/null || npm install --production --no-audit --no-fund
COPY . .
USER appuser
ENV PORT=3250 NODE_ENV=production
EXPOSE 3250
HEALTHCHECK --interval=15s --timeout=3s --start-period=20s --retries=3 CMD curl -fsS http://127.0.0.1:3250/health || exit 1
CMD ["node","index.mjs"]