# syntax=docker/dockerfile:1

FROM golang:1.26-alpine AS build
WORKDIR /src

# Dependencies first so edits to the source don't re-download the module cache.
COPY go.mod go.sum ./
RUN go mod download

COPY . .
RUN mkdir -p /out/releases
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -buildvcs=false \
    -ldflags="-s -w" -o /out/memby-server ./cmd/memby-server

# distroless/static carries CA certificates, which the gateway needs to reach an
# HTTPS Emby server, and runs as a non-root user by default.
FROM gcr.io/distroless/static-debian12:nonroot
WORKDIR /app
COPY --from=build /out/memby-server /app/memby-server
COPY --from=build --chown=nonroot:nonroot /out/releases /data/releases
EXPOSE 8080
USER nonroot:nonroot
ENTRYPOINT ["/app/memby-server"]