Dockerfile.sam-node

# Stage 1: Build
FROM golang:1.27.1@sha256:3680233e3204827fbdc66088528ae6d4b3d034f51d03a99d454f6de034888244 AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
ARG VERSION=devel
RUN CGO_ENABLED=0 GOOS=linux go build -buildvcs=false -ldflags="-X github.com/google/sam/internal/version.Version=${VERSION}" -o sam-node ./cmd/sam-node
# Pre-create the default data dir owned by the nonroot UID so that a fresh
# named/anonymous volume mounted over it inherits writable ownership instead
# of defaulting to root.
RUN mkdir -p /data-seed && chown 65532:65532 /data-seed

# Stage 2: Final
FROM gcr.io/distroless/static:nonroot@sha256:e2e927ec666bae08560abb3c55d0659eceabb657f56b6782ab500a9fc7f555e3
WORKDIR /tmp
COPY --from=builder --chown=nonroot:nonroot /app/sam-node /
COPY --from=builder --chown=nonroot:nonroot /data-seed /data
USER nonroot:nonroot
ENTRYPOINT ["/sam-node"]