FROM php:8.3-fpm-bookworm

RUN apt-get update && apt-get install -y --no-install-recommends libonig-dev libxml2-dev unzip \
    && docker-php-ext-install mbstring dom \
    && rm -rf /var/lib/apt/lists/*
COPY --from=composer:2 /usr/bin/composer /usr/local/bin/composer
WORKDIR /var/www/html
# Dependencies are Linux-native and rebuilt from the lock, never host-mounted.
COPY composer.json composer.lock ./
RUN composer install --no-interaction --prefer-dist --no-progress
COPY bin ./bin
COPY docker/php/entrypoint.sh /usr/local/bin/meshvault-entrypoint
COPY docker/php/zz-meshvault.conf /usr/local/etc/php-fpm.d/zz-meshvault.conf
RUN chmod 755 /usr/local/bin/meshvault-entrypoint
RUN mkdir -p /var/www/html/.phpunit.cache && chown www-data:www-data /var/www/html/.phpunit.cache

# The entire FPM process runs as the same identity used for library checks.
USER www-data
ENTRYPOINT ["meshvault-entrypoint"]
CMD ["php-fpm"]