FROM node:20-alpine

WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev

COPY src ./src
COPY migrations ./migrations

# node:20-alpine fournit déjà un utilisateur non-root "node"
USER node

ENV PORT=3000
CMD ["sh", "-c", "node src/migrate.js && node src/server.js"]