Dockerfile

# Build stage
FROM public.ecr.aws/docker/library/golang:1.24-alpine AS builder

# Set working directory
WORKDIR /build

# Copy go mod and sum files
COPY go.mod go.sum ./

# Download dependencies
RUN go mod download && go mod verify

# Copy source code
COPY . .

# Build the binary with security flags
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
    -ldflags='-w -s -extldflags "-static"' \
    -a -installsuffix cgo \
    -o url-shortener ./cmd/server/

# Final stage - minimal runtime image using alpine
FROM public.ecr.aws/docker/library/alpine:3.20

# Install security updates and ca-certificates
RUN apk update && apk upgrade && \
    apk add --no-cache ca-certificates tzdata && \
    update-ca-certificates && \
    rm -rf /var/cache/apk/*

# Copy binary from builder stage
COPY --from=builder /build/url-shortener /app/url-shortener

# Set working directory
WORKDIR /app

# # alpine image already comes with user and group nobody
RUN chown -R nobody:nobody /app && \
    chmod 0755 /app/url-shortener
    
# Switch to non-root user
USER nobody

# Expose port
EXPOSE 12345

# Health check
HEALTHCHECK --interval=60s --timeout=4s --start-period=5s --retries=5 \
    CMD wget --no-verbose --tries=1 --spider http://localhost:12345/health || exit 1

# Set security-related environment variables
ENV CGO_ENABLED=0
ENV GODEBUG=netdns=go

# Run the binary
ENTRYPOINT ["/app/url-shortener"]