20 lines
666 B
Text
20 lines
666 B
Text
|
# Multi-stage build for the transparency-log service.
|
||
|
|
# Build the static binary against the pinned Go toolchain used by CI
|
||
|
|
# (keeps the image reproducible from source).
|
||
|
|
FROM golang:1.23-alpine3.21 AS build
|
||
|
|
WORKDIR /src
|
||
|
|
RUN apk add --no-cache git ca-certificates
|
||
|
|
COPY go.mod go.sum ./
|
||
|
|
RUN go mod download
|
||
|
|
COPY . .
|
||
|
|
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" \
|
||
|
|
-o /out/transparency-log ./cmd/transparency-log
|
||
|
|
|
||
|
|
FROM gcr.io/distroless/static-debian12:nonroot
|
||
|
|
WORKDIR /app
|
||
|
|
COPY --from=build /out/transparency-log /app/transparency-log
|
||
|
|
EXPOSE 8080
|
||
|
|
USER nonroot:nonroot
|
||
|
|
ENTRYPOINT ["/app/transparency-log"]
|
||
|
|
CMD ["--addr=:8080", "--backend=memory"]
|