docker: use multi-stage build to reduce image size

Dockerfile

@@ -1,39 +1,46 @@
-FROM alpine:latest
+# ---------- Build stage ----------
+FROM alpine:3.20 AS builder
 
-# Install required dependencies
 RUN apk add --no-cache \
-    libxml2-dev \
+    build-base \
     curl-dev \
-    shadow \
-    git \
-    make \
-    gcc \
-    musl-dev \
-    pkgconf \
+    libxml2-dev \
     openssl-dev \
-    openrc
+    git \
+    pkgconf
 
-# Clone and install beaker
-RUN git clone https://git.bwaaa.monster/beaker /tmp/beaker \
-    && cd /tmp/beaker \
-    && make \
-    && make install \
-    && rm -rf /tmp/beaker
-
-# Import omnisearch source
 WORKDIR /app
 COPY . /app
 
-# Clone and install omnisearch
-RUN cd /app \
-    && make \
-    && make install-openrc
+RUN git clone https://git.bwaaa.monster/beaker /tmp/beaker && \
+    cd /tmp/beaker && \
+    make && make install && \
+    rm -rf /tmp/beaker
 
-# Enable OpenRC and start the service
-RUN rc-update add omnisearch default
+RUN make clean && make && strip bin/omnisearch
+
+# ---------- Runtime stage ----------
+FROM alpine:3.20
+
+RUN apk add --no-cache \
+    libcurl \
+    libxml2 \
+    openssl
+
+WORKDIR /app
+
+# Copy only required artifacts
+COPY --from=builder /app/bin/omnisearch /app/omnisearch
+COPY --from=builder /usr/lib/libbeaker.so /usr/lib/libbeaker.so
+COPY --from=builder /app/templates /app/templates
+COPY --from=builder /app/static /app/static
+
+# Security: non-root user
+RUN adduser -D appuser && chmod +x /app/omnisearch
+USER appuser
+
+ENV LD_LIBRARY_PATH=/usr/lib
 
-# Expose the default port
 EXPOSE 5000
 
-# Start OpenRC and the service
-CMD sh -c "openrc default && touch /run/openrc/softlevel && omnisearch"
+CMD ["/app/omnisearch"]