initial commit

Dockerfile.release

@@ -0,0 +1,68 @@
+# syntax=docker/dockerfile:1
+#
+# Release image, built by GoReleaser.
+#
+# This exists alongside the main `Dockerfile` rather than replacing it, because the
+# two answer different questions:
+#
+#   * `Dockerfile` builds the frontend, the SDK and the binary from source, so that
+#     `docker build .` always produces something runnable from a clean checkout.
+#   * `Dockerfile.release` consumes a binary GoReleaser has already cross-compiled,
+#     so a release never rebuilds the Go code a second time with different flags
+#     from the one that was checksummed, signed and published.
+#
+# The runtime layer is identical to the main Dockerfile's, so a release image and a
+# locally built image differ only in provenance, never in behaviour.
+#
+# GoReleaser assembles the build context with the compiled binary at
+# `go-bananas_linux_{arch}/go-bananas`, and `extra_files` supplies the frontend and
+# SDK bundles. Nothing here compiles anything.
+
+ARG ALPINE_VERSION=3.22
+
+FROM alpine:${ALPINE_VERSION}
+
+ARG VERSION=dev
+ARG TARGETARCH=amd64
+
+# curl is present only for the container health check; busybox wget would do, but
+# curl's exit codes are the ones the check reasons about. tzdata is needed because
+# timestamps are rendered in the configured locale.
+RUN apk add --no-cache ca-certificates tzdata curl \
+    && addgroup -g 65532 -S bananas \
+    && adduser -u 65532 -S -G bananas -H -s /sbin/nologin bananas
+
+# The build context is generated, so these paths are relative to it rather than to
+# the repository root. TARGETARCH is the Go arch name and matches the directory
+# GoReleaser wrote the binary into.
+COPY go-bananas_linux_${TARGETARCH}/go-bananas /usr/local/bin/go-bananas
+COPY web/dist /srv/web
+COPY sdk/dist /srv/sdk
+
+RUN chmod 0755 /usr/local/bin/go-bananas \
+    && mkdir -p /srv/data \
+    && chown -R bananas:bananas /srv
+
+USER 65532:65532
+WORKDIR /srv
+
+ENV BANANAS_HTTP_ADDR=:8080 \
+    BANANAS_STATIC_DIR=/srv/web \
+    BANANAS_SDK_DIR=/srv/sdk \
+    BANANAS_DATABASE_PATH=/srv/data/go-bananas.db \
+    BANANAS_LOG_FORMAT=json
+
+EXPOSE 8080
+VOLUME ["/srv/data"]
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
+    CMD curl --fail --silent --show-error http://127.0.0.1:8080/healthz || exit 1
+
+LABEL org.opencontainers.image.title="go-bananas" \
+      org.opencontainers.image.description="Runtime design-token service: author themes, serve them to any application at run time." \
+      org.opencontainers.image.version="${VERSION}" \
+      org.opencontainers.image.source="https://github.com/urpi/go-bananas" \
+      org.opencontainers.image.licenses="MIT" \
+      org.opencontainers.image.base.name="docker.io/library/alpine:3.22"
+
+ENTRYPOINT ["/usr/local/bin/go-bananas"]