# Multi-stage build for the transparency-log service.
# Build the static binary against the pinned Go toolchain used by CI
# (keeps the image reproducible from source).
FROM golang:1.23-alpine3.21 AS build
WORKDIR /src
RUN apk add --no-cache git ca-certificates
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" \
    -o /out/transparency-log ./cmd/transparency-log

FROM gcr.io/distroless/static-debian12:nonroot
WORKDIR /app
COPY --from=build /out/transparency-log /app/transparency-log
EXPOSE 8080
USER nonroot:nonroot
ENTRYPOINT ["/app/transparency-log"]
CMD ["--addr=:8080", "--backend=memory"]