Dockerfile

# Build stage
FROM golang:1.24-alpine AS builder

WORKDIR /app

# Install dependencies
RUN apk add --no-cache git ca-certificates

# Copy go mod files
COPY go.mod go.sum ./
RUN go mod download

# Copy source code
COPY . .

# Build the application
ARG SERVICE=ledger
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
    -ldflags="-w -s" \
    -o /app/bin/${SERVICE} \
    ./cmd/${SERVICE}

# Runtime stage - use distroless for security
FROM gcr.io/distroless/static-debian12:nonroot

WORKDIR /app

# Copy binary from builder
ARG SERVICE=ledger
COPY --from=builder /app/bin/${SERVICE} /app/service

# Copy CA certificates for HTTPS
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/

# Run as non-root user (65532 is the nonroot user in distroless)
USER 65532:65532

# Expose ports
EXPOSE 8080 9090

# Run the service
ENTRYPOINT ["/app/service"]