feat: pure-Go SQLite, distroless runtime images, no-CGO cross-compilation

[sarg3nt]

Summary

• Replace mattn/go-sqlite3 (CGO) with modernc.org/sqlite (pure Go) — eliminates CGO, enabling fast native cross-compilation for linux/arm64 without QEMU overhead
• Switch golang-migrate sqlite driver from database/sqlite3 (mattn) to database/sqlite (modernc-compatible)
• Switch both gearbox and gearbox-agent runtime images from Alpine to gcr.io/distroless/static-debian12:nonroot
• Drop internal HEALTHCHECK from both images — rely on external probes (Docker Compose / Kubernetes)
• Strip builder apk add down to git only — ca-certs, tzdata, gcc, musl-dev all removed

Expected outcome

• linux/arm64 Docker builds drop from 15–30 min to 2–4 min
• Runtime image attack surface reduced: no shell, no package manager, no wget
• gearbox-agent data directory (/var/lib/gearbox-agent) created at startup by existing os.MkdirAll in crypto.LoadOrCreateAPIKey

Test plan

• CGO_ENABLED=0 go build ./... passes in gearbox/
• Docker build completes for both linux/amd64 and linux/arm64
• gearbox starts and database initialises (WAL mode, migrations)
• gearbox-agent starts and creates /var/lib/gearbox-agent on first run

Closes #26

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR updates Gearbox to use a pure-Go SQLite driver to eliminate CGO and enable faster cross-compilation, while also switching both gearbox and gearbox-agent runtime containers to distroless images to reduce runtime surface area.

Changes:

• Replace mattn/go-sqlite3 with modernc.org/sqlite and update golang-migrate to use the modernc-compatible sqlite driver.
• Update Docker build to use CGO_ENABLED=0 and simplify builder dependencies.
• Switch runtime images to gcr.io/distroless/static-debian12:nonroot and remove Dockerfile-level health checks.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
gearbox/internal/framework/database/migrate_manager.go	Switch golang-migrate driver from sqlite3 to sqlite and update migrator instance name accordingly.
gearbox/internal/framework/database/database.go	Switch database/sql driver name from sqlite3 to sqlite and update blank import to modernc driver.
gearbox/go.mod	Remove CGO sqlite dependency and add modernc.org/sqlite (plus indirect deps).
gearbox/go.sum	Update module checksums to reflect the dependency switch.
gearbox/Dockerfile	Build with CGO_ENABLED=0 and change runtime base image to distroless :nonroot.
gearbox-agent/Dockerfile	Reduce builder deps and change runtime base image to distroless :nonroot.

Comments suppressed due to low confidence (1)

gearbox-agent/Dockerfile:41

• The image now runs as distroless :nonroot but still defaults HAPROXY_AGENT_DATA_DIR to /var/lib/gearbox-agent. On Debian-based images, /var/lib is root-owned, so os.MkdirAll("/var/lib/gearbox-agent", …) (triggered by API key/cert creation) will usually fail with permission denied. Ensure the data dir exists and is owned by the nonroot user at build time (e.g., create it in the builder stage and COPY --chown it into the final image), or switch the default to a writable path under /app and update docs/compose accordingly.

FROM gcr.io/distroless/static-debian12:nonroot

WORKDIR /app

# Copy binary from builder
COPY --from=go-builder /build/gearbox-agent .

# Expose API port
EXPOSE 8405

# Environment defaults (can be overridden)
ENV HAPROXY_AGENT_LISTEN=0.0.0.0:8405 \
    HAPROXY_AGENT_DATA_DIR=/var/lib/gearbox-agent \
    HAPROXY_AGENT_LOG_LEVEL=info