{
  lib,
  dockerTools,
  towerops,
  coreutils,
  bash,
  net-snmp,
}:

dockerTools.buildLayeredImage {
  name = "registry.gitlab.com/towerops/towerops";
  tag = "latest";

  # Maximum layers for optimal caching (Docker limit is 127, reserve 2 for image metadata)
  maxLayers = 125;

  # Contents: packages included in the image
  contents = [
    # Core utilities for basic shell operations
    coreutils
    bash

    # SNMP runtime: libnetsnmp.so for NIF + snmptranslate command
    net-snmp

    # Towerops release
    towerops
  ];

  # Image configuration
  config = {
    # Run as nobody user (non-root)
    User = "65534:65534";

    # Working directory
    WorkingDir = "${towerops}";

    # Command to run
    Cmd = [ "${towerops}/bin/server" ];

    # Environment variables
    Env = [
      "LANG=en_US.UTF-8"
      "LC_ALL=en_US.UTF-8"
      "MIX_ENV=prod"
      # Ensure snmptranslate is in PATH for NIF
      "PATH=${net-snmp}/bin:${coreutils}/bin:${bash}/bin"
    ];

    # Healthcheck: use Elixir RPC to verify BEAM is responsive
    Healthcheck = {
      Test = [
        "CMD-SHELL"
        "${towerops}/bin/towerops rpc \"1 + 1\" || exit 1"
      ];
      Interval = 30000000000; # 30s in nanoseconds
      Timeout = 5000000000; # 5s in nanoseconds
      Retries = 3;
      StartPeriod = 10000000000; # 10s in nanoseconds
    };

    # Expose port 4000 (Phoenix default)
    ExposedPorts = {
      "4000/tcp" = { };
    };

    # Labels for metadata
    Labels = {
      "org.opencontainers.image.title" = "Towerops";
      "org.opencontainers.image.description" = "Phoenix LiveView SNMP monitoring platform";
      "org.opencontainers.image.version" = towerops.version;
      "org.opencontainers.image.vendor" = "Towerops";
    };
  };

  # Created timestamp (set to epoch for reproducibility)
  created = "1970-01-01T00:00:01Z";
}