FROM alpine:3.18

# ---------- metadata ----------
LABEL maintainer="docker-escape-room@example.com" \
  version="14.0.0" \
  description="Docker Escape Room - Room 14 production-ready example" \
  password="bestprac14"

# ---------- system deps (single layer + cleanup) ----------
RUN apk add --no-cache \
  wget \
  curl

# ---------- non-root user ----------
RUN addgroup -S appgroup && adduser -S appuser -G appgroup

# ---------- app directory owned by appuser ----------
RUN mkdir -p /app && chown appuser:appgroup /app
WORKDIR /app

# ---------- health check ----------
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD wget -qO- http://localhost:8080/health 2>/dev/null || exit 1

# ---------- drop root ----------
USER appuser

CMD ["sh", "-c", "echo 'Room 14 container is running as non-root'; sleep infinity"]
