# Broker image: pinned upstream base + the platform bootstrap config.
#
# Why bake the config in instead of bind-mounting or entrypoint-copying:
#   * A FRESH mosquitto_config volume gets seeded from the IMAGE content
#     (Docker copy-up) — so first boot starts with OUR dynsec-enabled
#     config, not the stock anonymous one.
#   * Once the volume has content (bootstrap or deployed revisions), the
#     image never touches it again — control-sidecar deploys survive
#     restarts and image rebuilds.
#   * Bind-mounting the active file would break the control sidecar's
#     atomic os.replace() activation on deploy.
FROM eclipse-mosquitto:2.1.2-alpine

COPY bootstrap/mosquitto.conf /mosquitto/config/mosquitto.conf