FROM node:24-alpine

WORKDIR /app
ENV NODE_ENV=production

# install dependencies first so code-only changes reuse this layer
COPY package.json package-lock.json ./
RUN npm ci --omit=dev && npm cache clean --force

COPY src ./src

# no volume: sessions live in each user's browser, so the container keeps no state
USER node
EXPOSE 3000

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD wget -qO- http://127.0.0.1:3000/healthz || exit 1

CMD ["node", "src/server.js"]