# Shared build image for the fasten audit+correlation native core.
#
# Builds libfasten_core.so ONCE (Rust → cdylib) so the api/worker image can
# COPY it in without running cargo per service. fasten is vendored as a git
# submodule at ./fasten (github.com/nerdapplabs/fasten), pinned to a revision.
#
# Build (from the continuum repo root, with the submodule checked out):
#   docker build -t continuum/fasten-core:latest -f Dockerfile.fasten-core .
#
# Multi-arch (CI):
#   docker buildx build --platform linux/amd64,linux/arm64 \
#     -t <registry>/continuum/fasten-core:latest -f Dockerfile.fasten-core . --push
#
# Consumed by src/backend/api/Dockerfile:
#   ARG FASTEN_CORE_IMAGE=continuum/fasten-core:latest
#   FROM ${FASTEN_CORE_IMAGE} AS fasten-core
#   COPY --from=fasten-core /fasten/libfasten_core.so /fasten/libfasten_core.so
#   COPY --from=fasten-core /fasten/python            /opt/fasten/python
#   ENV  FASTEN_CORE_LIB=/fasten/libfasten_core.so
#   RUN  pip install --no-cache-dir "/opt/fasten/python[fastapi,postgres]"
ARG RUST_IMAGE=rust:1.85-slim

FROM ${RUST_IMAGE} AS builder
WORKDIR /build
# rusqlite is built with the `bundled` feature → compiles SQLite from source,
# so the only build-time system dep is a C toolchain (present in rust:slim).
COPY fasten/fasten-core/ ./fasten-core/
RUN cd fasten-core && cargo build --release --features all

# Thin artifact image: the glibc .so for Python services + the Python SDK source.
FROM debian:bookworm-slim
COPY --from=builder /build/fasten-core/target/release/libfasten_core.so /fasten/libfasten_core.so
COPY fasten/python/ /fasten/python/