Dockerfile

# syntax=docker/dockerfile:1

ARG GO_VERSION=1.26
ARG GO_BUILD_TAGS=cloud

FROM golang:${GO_VERSION}-bookworm AS build
ARG GO_BUILD_TAGS=cloud
WORKDIR /src

COPY go.mod go.sum ./
RUN go mod download

COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build \
    -tags="${GO_BUILD_TAGS}" \
    -trimpath \
    -ldflags="-s -w" \
    -o /out/vouch \
    ./cmd/vouch
RUN mkdir -p /out/cache

FROM gcr.io/distroless/static-debian12:nonroot AS runtime
WORKDIR /app

COPY --from=build /out/vouch /vouch
COPY --from=build --chown=nonroot:nonroot /out/cache /app/.cache
COPY deploy/docker/config.yaml /etc/vouch/config.yaml

EXPOSE 18080
USER nonroot:nonroot

ENTRYPOINT ["/vouch"]
CMD ["-config", "/etc/vouch/config.yaml"]