# See services/iam/Dockerfile for the pattern explanation. Workspace
# additionally needs common CLI tools available inside the container
# for run_bash_command (git, go, node, python...) — extend this image's
# second stage as your allowlist (ENKLY_BASH_ALLOWLIST) requires; kept
# minimal here since the allowlist itself is operator-configured.
FROM golang:1.23-bookworm AS build
WORKDIR /src
COPY go.mod go.sum* ./
COPY gen/ gen/
COPY pkg/ pkg/
COPY services/workspace/ services/workspace/
RUN go mod tidy
RUN CGO_ENABLED=0 go build -o /out/workspace-server ./services/workspace/cmd/server

FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates git && rm -rf /var/lib/apt/lists/*
WORKDIR /app
COPY --from=build /out/workspace-server ./workspace-server
ENV ENKLY_WORKSPACE_GRPC_ADDR=:9004
ENV ENKLY_WORKSPACE=/data/workspace
VOLUME ["/data/workspace"]
EXPOSE 9004
ENTRYPOINT ["./workspace-server"]