content: FROM rust:latest AS planner
  WORKDIR /app
  RUN cargo install cargo-chef
  COPY . .
  # Compute a lock-like file for our project
  RUN cargo chef prepare  --recipe-path recipe.json
  
  FROM rust:latest AS cacher
  WORKDIR /app
  RUN cargo install cargo-chef
  COPY --from=planner /app/recipe.json recipe.json
  # Build our project dependencies, not our application!
  RUN cargo chef cook --release --recipe-path recipe.json
  
  FROM rust:latest AS builder
  WORKDIR /app
  
  # Copy over the cached dependencies
  COPY --from=cacher /app/target target
  COPY --from=cacher /usr/local/cargo /usr/local/cargo
  COPY . .
  
  RUN cargo build --release --bin backchannel
  
  FROM debian:buster-slim AS runtime
  WORKDIR /home/nonroot/
  RUN apt-get update -y \
      && apt-get install -y --no-install-recommends tini \
      # Clean up
      && apt-get autoremove -y && apt-get clean -y && rm -rf /var/lib/apt/lists/*
  
  
  # Non-root user for security purposes.
  #
  # UIDs below 10,000 are a security risk, as a container breakout could result
  # in the container being ran as a more privileged user on the host kernel with
  # the same UID.
  #
  # Static GID/UID is also useful for chown'ing files outside the container where
  # such a user does not exist.
  RUN groupadd --gid 10001 nonroot && \
      useradd  --home-dir /home/nonroot \
               --create-home \
               --shell /bin/bash \
               --gid nonroot \
               --groups nonroot \
               --uid 10000 nonroot
  
  COPY --from=builder /app/target/release/backchannel backchannel
  RUN chown nonroot:nonroot backchannel
  
  USER nonroot
  EXPOSE 3000
  # Tini allows us to avoid several Docker edge cases, see https://github.com/krallin/tini.
  ENTRYPOINT ["tini", "--", "bash"]