FROM gcr.io/distroless/static-debian12:nonroot@sha256:aef9602f8710ec12bde19d593fed1f76c708531bb7aba205110f1029786ead7b

ARG SOURCE_SHA
LABEL org.opencontainers.image.source="https://github.com/pingcap-inc/nexuscrm-app-packs" \
      org.opencontainers.image.revision="${SOURCE_SHA}" \
      io.nexuscrm.app.id="io.nexuscrm.sfcrm" \
      io.nexuscrm.capability="io.nexuscrm.sfcrm.ui.record-access.v1" \
      io.nexuscrm.service-capabilities="[\"io.nexuscrm.sfcrm.google-login-state.v1\"]"
COPY --chown=nonroot:nonroot appservices/sfcrm/sfcrm-appservice-binary /usr/local/bin/sfcrm-appservice

USER nonroot:nonroot
ENTRYPOINT ["/usr/local/bin/sfcrm-appservice"]