# syntax=docker/dockerfile:1
# Packages the binaries deploy/build.sh already built (dist/bin/linux_<arch>/hammerhead),
# so the arm64 image needs no emulation. Build it with:  sh deploy/build.sh && docker buildx build .
FROM --platform=$BUILDPLATFORM alpine:3.22 AS prep
RUN apk add --no-cache ca-certificates \
 && mkdir /data && chown 65532:65532 /data

FROM scratch
ARG TARGETARCH
LABEL org.opencontainers.image.title="Hammerhead" \
      org.opencontainers.image.description="Control plane for tunnelled ports and websites" \
      org.opencontainers.image.source="https://git.veillax.com/Veillax/hammerhead" \
      org.opencontainers.image.licenses="AGPL-3.0-only"
COPY --from=prep /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=prep --chown=65532:65532 /data /data
COPY dist/bin/linux_${TARGETARCH}/hammerhead /hammerhead
USER 65532:65532
ENV HAMMERHEAD_DATA=/data
VOLUME ["/data"]
EXPOSE 8080
ENTRYPOINT ["/hammerhead"]
CMD ["-listen", ":8080"]