# syntax=docker/dockerfile:1

FROM golang:1.25-alpine AS build
WORKDIR /src

# Cache module downloads (including the local certspotter fork's deps).
COPY go.mod go.sum ./
COPY third_party/certspotter/go.mod third_party/certspotter/go.sum ./third_party/certspotter/
RUN go mod download

COPY . .

# Static binary: no cgo, no shell, no writable filesystem required.
RUN CGO_ENABLED=0 GOOS=linux go build \
        -trimpath -ldflags="-s -w" \
        -o /out/ctcloud ./cmd/ctcloud

FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=build /out/ctcloud /ctcloud
USER nonroot:nonroot
EXPOSE 9090
ENTRYPOINT ["/ctcloud"]