Dockerfile

# =============================================================================
# Stage 1: builder
# =============================================================================
FROM golang:1.26.3-alpine AS builder

# Install git (needed by some go modules) and build essentials
RUN apk add --no-cache git

WORKDIR /build

# Use local toolchain so go.mod's future 'go' directive doesn't block the build
ENV GOTOOLCHAIN=local
ENV CGO_ENABLED=0
ENV GOOS=linux
ENV GOARCH=amd64

# Download dependencies in a separate layer for better layer caching
COPY go.mod go.sum ./
RUN go mod download

# Copy the full source tree
COPY . .

# Build a statically-linked binary
RUN go build -trimpath -ldflags="-s -w" -o /app/server ./cmd/main.go

# =============================================================================
# Stage 2: runner
# =============================================================================
FROM alpine:3.19 AS runner

# ca-certificates: required for HTTPS calls to GitHub API and other TLS endpoints
# tzdata: keeps time-zone handling consistent
RUN apk add --no-cache ca-certificates tzdata

# Create a non-root user and group
RUN addgroup -S appgroup && adduser -S appuser -G appgroup

WORKDIR /app

# Copy the compiled binary from the builder stage
COPY --from=builder /app/server ./server

# Copy the default config file (may be overridden by a bind-mount at runtime)
COPY config.yaml ./config.yaml

# Copy frontend static files
COPY --from=builder /build/frontend ./frontend

# Drop to non-root
USER appuser

EXPOSE 8080

# Run the server
CMD ["/app/server"]