Dockerfile.foreman-agent

# Build stage: full Go toolchain on a small base.
FROM --platform=$BUILDPLATFORM golang:1.27.3-alpine AS builder

ARG TARGETOS
ARG TARGETARCH

WORKDIR /workspace

# Dependency layer cache. The script retries a network error from the
# module proxy (#2380).
COPY go.mod go.sum ./
COPY hack/go-mod-download.sh hack/go-mod-download.sh
RUN sh hack/go-mod-download.sh

COPY api/ api/
COPY cmd/ cmd/
COPY internal/ internal/
COPY pkg/ pkg/

# Static build so the resulting binary runs on alpine without libc.
RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} \
    go build -trimpath -ldflags="-s -w" -o foreman-agent ./cmd/foreman-agent

# Runtime stage: alpine + git. The foreman-agent shells out to `git`
# from its repo helpers (clone / commit / push), so we cannot use
# distroless-static. Alpine is small (~7 MiB base + git ~5 MiB) and
# still gives us a non-root user.
FROM alpine:3.24

# apk upgrade before apk add: the alpine:3.24 base image is rebuilt less
# often than its package repo is published, so packages baked into the
# base can sit behind a published fix even on a fresh build. Trivy scans
# this image before push and fails the release on HIGH findings, so the
# upgrade is what keeps a base-image lag from blocking a release
# (CVE-2026-14456: libcrypto3/libssl3 3.5.7-r0 in the base, 3.5.8-r0 in
# the v3.24 repo).
RUN apk upgrade --no-cache \
    && apk add --no-cache git ca-certificates \
    && addgroup -S -g 65532 nonroot \
    && adduser -S -u 65532 -G nonroot nonroot

WORKDIR /
COPY --from=builder /workspace/foreman-agent /foreman-agent

USER 65532:65532

ENTRYPOINT ["/foreman-agent"]