Dockerfile.server

# Multi-stage Chainguard TMI application build
# Stage 1: Build environment using Chainguard Go image
FROM cgr.dev/chainguard/go:latest AS builder

# Metadata for tracking
LABEL security.scan-date="AUTO_GENERATED"
LABEL security.patch-level="high-critical"
LABEL maintainer="TMI Security Team"

# Set working directory
WORKDIR /app

# Copy go mod files
COPY go.mod go.sum ./

# Download dependencies with security verification
RUN go mod download && \
    go mod verify

# Copy source code
COPY . .

# Build the application with security flags (CGO disabled for static binary)
# Note: Oracle support is excluded (requires CGO). To include Oracle, use -tags oracle with CGO_ENABLED=1
# Chainguard Go image includes git, so git commands will work
# Read version from .version file (same source of truth as Makefile)
RUN MAJOR=$(cat .version | grep '"major"' | grep -o '[0-9]*') && \
    MINOR=$(cat .version | grep '"minor"' | grep -o '[0-9]*') && \
    PATCH=$(cat .version | grep '"patch"' | grep -o '[0-9]*') && \
    PRERELEASE=$(cat .version | grep '"prerelease"' | sed 's/.*: *"\(.*\)".*/\1/') && \
    CGO_ENABLED=0 GOOS=linux go build \
    -ldflags "-s -w -X github.com/ericfitz/tmi/api.VersionMajor=${MAJOR} -X github.com/ericfitz/tmi/api.VersionMinor=${MINOR} -X github.com/ericfitz/tmi/api.VersionPatch=${PATCH} -X github.com/ericfitz/tmi/api.VersionPreRelease=${PRERELEASE} -X github.com/ericfitz/tmi/api.GitCommit=$(git rev-parse --short HEAD 2>/dev/null || echo 'development') -X github.com/ericfitz/tmi/api.BuildDate=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
    -trimpath \
    -buildmode=exe \
    -o tmiserver \
    ./cmd/server

# Stage 2: Chainguard static runtime (minimal attack surface)
FROM cgr.dev/chainguard/static:latest

# Metadata for tracking security patches
LABEL security.chainguard="true"
LABEL security.scan-date="AUTO_GENERATED"
LABEL security.patch-level="minimal-attack-surface"
LABEL maintainer="TMI Security Team"
LABEL org.opencontainers.image.title="TMI Server"
LABEL org.opencontainers.image.description="TMI Server on Chainguard static base"
LABEL org.opencontainers.image.name="tmi/tmi-server"

# Copy binary from builder
COPY --from=builder /app/tmiserver /tmiserver

# Note: No static files needed - migrations use GORM AutoMigrate (schema from Go code)

# Set working directory
WORKDIR /

# Expose port 8080
EXPOSE 8080

# Set secure environment variables
ENV ENV=development
ENV LOG_LEVEL=info
ENV SERVER_PORT=8080
ENV SERVER_INTERFACE=0.0.0.0
ENV GOLANG_PROTOBUF_REGISTRATION_CONFLICT=warn

# Note: Chainguard static doesn't include a shell
# Health checks should be done externally via Kubernetes/Docker probes

# Run as non-root user (Chainguard static runs as nonroot by default)
USER nonroot:nonroot

# Run the application
ENTRYPOINT ["/tmiserver"]