# Patchwork as a container: one static binary on distroless, running as
# nonroot. The database lives in /var/lib/patchwork; mount a volume there.

FROM golang:1.26-alpine AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
ARG VERSION=dev
RUN CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.version=${VERSION}" -o /out/patchwork ./cmd/patchwork
# An empty data directory owned by nonroot (65532), so a fresh named volume
# mounted here inherits that owner and the database can be created.
RUN mkdir -p /out/data && chown 65532:65532 /out/data

FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=build /out/patchwork /patchwork
COPY --from=build --chown=65532:65532 /out/data /var/lib/patchwork
ENV PATCHWORK_CONFIG=/etc/patchwork/patchwork.yaml
EXPOSE 8080
VOLUME ["/var/lib/patchwork"]
ENTRYPOINT ["/patchwork"]
CMD ["serve"]