FROM mcr.microsoft.com/dotnet/sdk:10.0-noble-aot AS build

WORKDIR /src/backend
# 构建信息：CI 通过 --build-arg 传入；不传就是空
ARG MONITOR_TAG=
ARG MONITOR_COMMIT=
ARG MONITOR_BUILT_AT=
ENV MONITOR_TAG=$MONITOR_TAG MONITOR_COMMIT=$MONITOR_COMMIT MONITOR_BUILT_AT=$MONITOR_BUILT_AT
COPY restore/backend/ ./
# restore 也要带 PublishAot：不然不会还原 ILCompiler，之后 --no-restore 的发布就悄悄变成「裁剪过的框架依赖程序」
RUN dotnet restore probe/src/Monitor.Probe -r linux-x64 -p:PublishAot=true --artifacts-path /artifacts

COPY source/backend/ ./
RUN dotnet publish probe/src/Monitor.Probe -m:3 -c Release -r linux-x64 \
    --self-contained true --no-restore -p:PublishAot=true -p:UseAotAnywhere=false \
    -p:UseAppHost=true -p:StripSymbols=true \
    -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/probe
# 原生程序有几 MB；几十 KB 的是只会去找 .dll 的启动器
RUN test -x /out/probe/monitor-probe \
    && test "$(stat -c%s /out/probe/monitor-probe)" -gt 2000000

FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-noble-chiseled-extra

ARG APP_VERSION=main
LABEL org.opencontainers.image.title="Monitor Probe" \
      org.opencontainers.image.description="MyMonitor network measurement probe for Linux" \
      org.opencontainers.image.licenses="Apache-2.0" \
      org.opencontainers.image.version="$APP_VERSION"

COPY --chown=1654:1654 --from=build /out/probe/monitor-probe /usr/local/bin/monitor-probe
COPY --chown=1654:1654 config/ /etc/monitor/

USER 1654:1654
WORKDIR /etc/monitor
VOLUME ["/etc/monitor"]
ENTRYPOINT ["/usr/local/bin/monitor-probe"]
CMD ["--config", "/etc/monitor/probe.json"]