# syntax=docker/dockerfile:1
#
# Release image, built by GoReleaser.
#
# This exists alongside the main `Dockerfile` rather than replacing it, because the
# two answer different questions:
#
#   * `Dockerfile` builds the frontend, the SDK and the binary from source, so that
#     `docker build .` always produces something runnable from a clean checkout.
#   * `Dockerfile.release` consumes a binary GoReleaser has already cross-compiled,
#     so a release never rebuilds the Go code a second time with different flags
#     from the one that was checksummed, signed and published.
#
# The runtime layer is identical to the main Dockerfile's, so a release image and a
# locally built image differ only in provenance, never in behaviour.
#
# GoReleaser assembles the build context with the compiled binary at
# `go-bananas_linux_{arch}/go-bananas`, and `extra_files` supplies the frontend and
# SDK bundles. Nothing here compiles anything.

ARG ALPINE_VERSION=3.22

FROM alpine:${ALPINE_VERSION}

ARG VERSION=dev
ARG TARGETARCH=amd64

# curl is present only for the container health check; busybox wget would do, but
# curl's exit codes are the ones the check reasons about. tzdata is needed because
# timestamps are rendered in the configured locale.
RUN apk add --no-cache ca-certificates tzdata curl \
    && addgroup -g 65532 -S bananas \
    && adduser -u 65532 -S -G bananas -H -s /sbin/nologin bananas

# The build context is generated, so these paths are relative to it rather than to
# the repository root. TARGETARCH is the Go arch name and matches the directory
# GoReleaser wrote the binary into.
COPY go-bananas_linux_${TARGETARCH}/go-bananas /usr/local/bin/go-bananas
COPY web/dist /srv/web
COPY sdk/dist /srv/sdk

RUN chmod 0755 /usr/local/bin/go-bananas \
    && mkdir -p /srv/data \
    && chown -R bananas:bananas /srv

USER 65532:65532
WORKDIR /srv

ENV BANANAS_HTTP_ADDR=:8080 \
    BANANAS_STATIC_DIR=/srv/web \
    BANANAS_SDK_DIR=/srv/sdk \
    BANANAS_DATABASE_PATH=/srv/data/go-bananas.db \
    BANANAS_LOG_FORMAT=json

EXPOSE 8080
VOLUME ["/srv/data"]

HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
    CMD curl --fail --silent --show-error http://127.0.0.1:8080/healthz || exit 1

LABEL org.opencontainers.image.title="go-bananas" \
      org.opencontainers.image.description="Runtime design-token service: author themes, serve them to any application at run time." \
      org.opencontainers.image.version="${VERSION}" \
      org.opencontainers.image.source="https://github.com/urpi/go-bananas" \
      org.opencontainers.image.licenses="MIT" \
      org.opencontainers.image.base.name="docker.io/library/alpine:3.22"

ENTRYPOINT ["/usr/local/bin/go-bananas"]