FROM golang:1.26.9-bookworm@sha256:d9c68c2c51161e12fd77e4c6320687c9cd86e1af1e3ad6e6cd63ff970641453c AS build
ENV GOMAXPROCS=2
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN go mod vendor && go test ./... && CGO_ENABLED=0 go build -trimpath -ldflags='-s -w -X main.version=v0.5.2-newsroom.1' -o /out/ghostbird ./cmd/ghostbird
# Corresponding source is built from this exact context, without runtime files.
# Fixed timestamps, ownership, ordering and gzip header make it reproducible.
RUN tar --sort=name --mtime=@0 --owner=0 --group=0 --numeric-owner -cf - . | gzip -n > /out/source.tar.gz
RUN mkdir -p /out/data /out/backups

FROM scratch
COPY --from=build /out/ghostbird /usr/local/bin/ghostbird
COPY --from=build /out/source.tar.gz /usr/share/ghostbird/source.tar.gz
COPY --from=build --chown=10001:10001 /out/data /data
COPY --from=build --chown=10001:10001 /out/backups /backups
USER 10001:10001
ENV GOMEMLIMIT=160MiB GOMAXPROCS=2
ENTRYPOINT ["/usr/local/bin/ghostbird"]
