Dockerfile.foreman-operator

# Build stage: full Go toolchain on a small base.
FROM --platform=$BUILDPLATFORM golang:1.27.3-alpine AS builder

ARG TARGETOS
ARG TARGETARCH

WORKDIR /workspace

# Dependency layer cache. The script retries a network error from the
# module proxy (#2380).
COPY go.mod go.sum ./
COPY hack/go-mod-download.sh hack/go-mod-download.sh
RUN sh hack/go-mod-download.sh

COPY api/ api/
COPY cmd/ cmd/
COPY internal/ internal/
COPY pkg/ pkg/

# Static build so the resulting binary runs on distroless-static.
RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} \
    go build -trimpath -ldflags="-s -w" -o foreman-operator ./cmd/foreman-operator

# Runtime stage: distroless static, non-root, no shell.
FROM gcr.io/distroless/static:nonroot

WORKDIR /
COPY --from=builder /workspace/foreman-operator /foreman-operator

USER 65532:65532

ENTRYPOINT ["/foreman-operator"]