Dockerfile hardening for smaller safer containers

                  FROM ruby:3.3.1-slim AS base

RUN apt-get update \
  && apt-get install -y --no-install-recommends build-essential libpq-dev \
  && rm -rf /var/lib/apt/lists/*

WORKDIR /app
RUN groupadd --system app && useradd --system --gid app --create-home app

COPY Gemfile Gemfile.lock ./
RUN bundle config set deployment 'true' && bundle install --without development test

COPY . .
RUN chown -R app:app /app

USER app
CMD ["bundle", "exec", "puma", "-C", "config/puma.rb"]