cd: implement dockerfile and release process for container

.github/workflows/release-binaries.yml

@@ -9,6 +9,7 @@ on:
 
 permissions:
   contents: write
+  packages: write
 
 jobs:
   bin-releaser:
@@ -22,8 +23,18 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.24.x"
-      - name: Release Binaries
+          go-version: "1.25.x"
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Release Binaries and Containers
         uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser

.goreleaser.yaml

@@ -45,5 +45,43 @@ archives:
         formats:
           - zip
 
+release:
+  mode: keep-existing
+
 changelog:
   disable: true
+
+dockers:
+  # AMD64 image
+  - image_templates:
+      - "ghcr.io/storacha/guppy:{{ .Version }}-amd64"
+    dockerfile: Dockerfile.release
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/amd64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.title={{.ProjectName}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Version}}"
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+    goarch: amd64
+
+  # ARM64 image
+  - image_templates:
+      - "ghcr.io/storacha/guppy:{{ .Version }}-arm64"
+    dockerfile: Dockerfile.release
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/arm64"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.title={{.ProjectName}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Version}}"
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+    goarch: arm64
+
+docker_manifests:
+  - name_template: "ghcr.io/storacha/guppy:{{ .Version }}"
+    image_templates:
+      - "ghcr.io/storacha/guppy:{{ .Version }}-amd64"
+      - "ghcr.io/storacha/guppy:{{ .Version }}-arm64"

Dockerfile

@@ -0,0 +1,89 @@
+# ============================================
+# Build stage (shared)
+# ============================================
+FROM golang:1.25.3-trixie AS build
+
+# Docker sets TARGETARCH automatically during multi-platform builds
+ARG TARGETARCH
+
+WORKDIR /go/src/guppy
+
+COPY go.* .
+RUN go mod download
+COPY . .
+
+# Production build - with symbol stripping
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} make guppy-prod
+
+# ============================================
+# Debug build stage
+# ============================================
+FROM build AS build-debug
+
+ARG TARGETARCH
+
+# Install delve debugger and randdir tool for target architecture
+RUN GOARCH=${TARGETARCH} go install github.com/go-delve/delve/cmd/dlv@latest && \
+    GOARCH=${TARGETARCH} go install github.com/storacha/randdir@latest
+
+# Debug build - no optimizations, no inlining
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} make guppy-debug
+
+# ============================================
+# Production image
+# ============================================
+FROM debian:bookworm-slim AS prod
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=build /go/src/guppy/guppy /usr/bin/guppy
+
+ENTRYPOINT ["/usr/bin/guppy"]
+
+# ============================================
+# Development image
+# ============================================
+FROM debian:bookworm-slim AS dev
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    # Shell experience
+    bash-completion \
+    less \
+    vim-tiny \
+    # Process debugging
+    procps \
+    htop \
+    strace \
+    # Network debugging
+    iputils-ping \
+    dnsutils \
+    net-tools \
+    tcpdump \
+    # Data tools
+    jq \
+    && rm -rf /var/lib/apt/lists/*
+
+# Delve debugger and randdir tool
+COPY --from=build-debug /go/bin/dlv /usr/bin/dlv
+COPY --from=build-debug /go/bin/randdir /usr/bin/randdir
+
+# Debug binary (with symbols, no optimizations)
+COPY --from=build-debug /go/src/guppy/guppy /usr/bin/guppy
+
+# Create data directories
+RUN mkdir -p /root/.storacha/guppy /root/.config/guppy
+
+WORKDIR /root
+
+# Shell niceties
+ENV TERM=xterm-256color
+RUN echo 'alias ll="ls -la"' >> /etc/bash.bashrc && \
+    echo 'PS1="\[\e[32m\][guppy-dev]\[\e[m\] \w# "' >> /etc/bash.bashrc
+
+SHELL ["/bin/bash", "-c"]
+ENTRYPOINT ["/usr/bin/guppy"]

Dockerfile.release

@@ -0,0 +1,7 @@
+FROM debian:bookworm-slim
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    && rm -rf /var/lib/apt/lists/*
+COPY guppy /usr/bin/guppy
+ENTRYPOINT ["/usr/bin/guppy"]

Makefile

@@ -1,10 +1,16 @@
-.PHONY: build test clean migration migrate-up migrate-down migrate-status migrate-reset
+.PHONY: build test clean migration migrate-up migrate-down migrate-status migrate-reset guppy-prod guppy-debug docker-setup docker-prod docker-dev
 
 BINARY ?= guppy
 MIGRATIONS_DIR ?= pkg/preparation/sqlrepo/migrations
 DB_PATH ?= ~/.storacha/guppy/preparation.db
 GOOSE := go tool goose
 
+VERSION=$(shell awk -F'"' '/"version":/ {print $$4}' version.json)
+COMMIT=$(shell git rev-parse --short HEAD)
+DATE=$(shell date -u -Iseconds)
+GOFLAGS=-ldflags="-X github.com/storacha/guppy/pkg/build.version=$(VERSION) -X github.com/storacha/guppy/pkg/build.Commit=$(COMMIT) -X github.com/storacha/guppy/pkg/build.Date=$(DATE) -X github.com/storacha/guppy/pkg/build.BuiltBy=make"
+DOCKER?=$(shell which docker)
+
 build:
 	go build -o $(BINARY) .
 
@@ -30,3 +36,23 @@ migrate-status:
 
 migrate-reset:
 	$(GOOSE) -dir $(MIGRATIONS_DIR) sqlite3 $(DB_PATH) reset
+
+# Production binary - stripped symbols for smaller size
+guppy-prod:
+	@echo "Building guppy (production)..."
+	go build -ldflags="-s -w -X github.com/storacha/guppy/pkg/build.version=$(VERSION) -X github.com/storacha/guppy/pkg/build.Commit=$(COMMIT) -X github.com/storacha/guppy/pkg/build.Date=$(DATE) -X github.com/storacha/guppy/pkg/build.BuiltBy=make" -o ./guppy .
+
+# Debug binary - no optimizations, no inlining, full symbols
+guppy-debug:
+	@echo "Building guppy (debug)..."
+	go build -gcflags="all=-N -l" -ldflags="-X github.com/storacha/guppy/pkg/build.version=$(VERSION) -X github.com/storacha/guppy/pkg/build.Commit=$(COMMIT) -X github.com/storacha/guppy/pkg/build.Date=$(DATE) -X github.com/storacha/guppy/pkg/build.BuiltBy=make-debug" -o ./guppy .
+
+# Docker targets (multi-arch: amd64 + arm64)
+docker-setup:
+	$(DOCKER) buildx create --name multiarch --use 2>/dev/null || $(DOCKER) buildx use multiarch
+
+docker-prod: docker-setup
+	$(DOCKER) buildx build --platform linux/amd64,linux/arm64 --target prod -t guppy:latest .
+
+docker-dev: docker-setup
+	$(DOCKER) buildx build --platform linux/amd64,linux/arm64 --target dev -t guppy:dev .