chore: docker

.dockerignore

@@ -0,0 +1,5 @@
+target
+.git
+.env
+*.sqlite
+*.sqlite-*

Dockerfile

@@ -0,0 +1,21 @@
+# Debian release pinned on both stages so the binary's glibc matches at runtime.
+# The image tag pins the compiler, so rust-toolchain.toml (and its editor
+# components) is intentionally not copied in.
+FROM rust:1.91-slim-bookworm AS build
+WORKDIR /src
+COPY Cargo.toml Cargo.lock ./
+COPY src ./src
+RUN cargo build --release --bin cities-labeler
+
+FROM debian:bookworm-slim
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+COPY --from=build /src/target/release/cities-labeler /usr/local/bin/cities-labeler
+COPY data /app/data
+ENV CITIES_PATH=/app/data/cities.json \
+    DB_PATH=/data/labeler.sqlite \
+    PORT=4100
+USER 1000:1000
+EXPOSE 4100
+CMD ["cities-labeler"]