# syntax=docker/dockerfile:1
# Packages a binary that was already built for each architecture, so the arm64 image needs
# no emulation. Build the binaries, then the image:
#
#   for a in amd64 arm64; do
#     mkdir -p dist/bin/linux_$a
#     CGO_ENABLED=0 GOOS=linux GOARCH=$a go build -trimpath -ldflags "-s -w" -o dist/bin/linux_$a/sandbar ./cmd/sandbar
#   done
#   docker buildx build --platform linux/amd64,linux/arm64 -t sandbar .
FROM --platform=$BUILDPLATFORM alpine:3.22 AS prep
RUN apk add --no-cache ca-certificates \
 && mkdir /data && chown 65532:65532 /data

FROM scratch
ARG TARGETARCH
LABEL org.opencontainers.image.title="Sandbar" \
      org.opencontainers.image.description="Notifications, monitoring, on-call and incident response" \
      org.opencontainers.image.source="https://git.veillax.com/Veillax/sandbar" \
      org.opencontainers.image.licenses="AGPL-3.0-only"
COPY --from=prep /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=prep --chown=65532:65532 /data /data
COPY dist/bin/linux_${TARGETARCH}/sandbar /sandbar
USER 65532:65532
ENV SANDBAR_DATA=/data
VOLUME ["/data"]
EXPOSE 8090
ENTRYPOINT ["/sandbar"]
CMD ["-listen", ":8090"]