Dockerfile.controller

# Multi-stage Chainguard build for the TMIComponent controller.
# Stage 1: Build environment using Chainguard Go image
FROM cgr.dev/chainguard/go:latest AS builder

# Metadata for tracking
LABEL security.scan-date="AUTO_GENERATED"
LABEL security.patch-level="high-critical"
LABEL maintainer="TMI Security Team"

# Set working directory
WORKDIR /app

# Copy go mod files and staged tmi-client dependency
COPY go.mod go.sum ./
COPY .docker-deps/tmi-client/ /tmi-client/

# Rewrite go.mod replace directive to point at the in-container client path
RUN sed -i 's|=> ../tmi-clients/go-client-generated/[^ ]*|=> /tmi-client|' go.mod

# Download dependencies with security verification
RUN go mod download && \
    go mod verify

# Copy source code
COPY . .

# Build the controller (CGO disabled for static binary)
RUN CGO_ENABLED=0 GOOS=linux go build \
    -trimpath \
    -buildmode=exe \
    -o component-controller \
    ./cmd/component-controller

# Stage 2: Chainguard static runtime (minimal attack surface)
FROM cgr.dev/chainguard/static:latest

# Metadata for tracking security patches
LABEL security.chainguard="true"
LABEL security.scan-date="AUTO_GENERATED"
LABEL security.patch-level="minimal-attack-surface"
LABEL maintainer="TMI Security Team"
LABEL org.opencontainers.image.title="TMI Component Controller"
LABEL org.opencontainers.image.description="TMI Component Controller on Chainguard static base"
LABEL org.opencontainers.image.name="tmi/tmi-component-controller"

# Copy binary from builder
COPY --from=builder /app/component-controller /component-controller

# Set working directory
WORKDIR /

# Run as non-root user (Chainguard static runs as nonroot by default)
USER nonroot:nonroot

# Run the controller
ENTRYPOINT ["/component-controller"]