Dockerfile

# Build stage — run on the build host's native arch for speed, cross-compile for target
FROM --platform=$BUILDPLATFORM golang:1.26.2-alpine3.23 AS builder

ARG TARGETOS
ARG TARGETARCH
ARG TARGETVARIANT

WORKDIR /app

# Install ca-certificates for HTTPS requests.
# Do not pin the apk revision here: Alpine rotates package revisions
# within a release branch, which breaks Docker builds over time.
RUN apk add --no-cache ca-certificates

# Download dependencies first for better layer caching
COPY go.mod go.sum ./
RUN go mod download

# Copy source and cross-compile for the target platform
COPY . .
ARG VERSION=dev
ARG COMMIT=none
ARG DATE=unknown
RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} GOARM=${TARGETVARIANT#v} go build \
	-ldflags="-s -w -X gomodel/internal/version.Version=${VERSION} -X gomodel/internal/version.Commit=${COMMIT} -X gomodel/internal/version.Date=${DATE}" \
	-o /gomodel ./cmd/gomodel

# Create .cache and data directories for runtime (with placeholder for COPY)
RUN mkdir -p /app/.cache /app/data && touch /app/.cache/.keep /app/data/.keep

# Runtime stage
FROM gcr.io/distroless/static-debian12:nonroot

# Copy binary and ca-certificates
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /gomodel /gomodel
COPY --from=builder /app/config/*.yaml /app/config/

# Create writable .cache and data directories for nonroot user (UID=65532)
COPY --from=builder --chown=65532:65532 /app/.cache /app/.cache
COPY --from=builder --chown=65532:65532 /app/data /app/data

WORKDIR /app

EXPOSE 8080

ENTRYPOINT ["/gomodel"]