Dockerfile

# Build the manager binary
FROM --platform=$BUILDPLATFORM golang:1.26.4 AS builder

ARG TARGETOS
ARG TARGETARCH
ARG VERSION=dev
ARG GIT_COMMIT=unknown
ARG BUILD_DATE=unknown

WORKDIR /workspace

# Cache dependencies - this layer is invalidated only when go.mod/go.sum change
COPY go.mod go.sum ./
RUN --mount=type=cache,target=/go/pkg/mod \
    go mod download

# Copy source code
COPY cmd/ cmd/
COPY api/ api/
COPY internal/ internal/
COPY pkg/ pkg/

# Build with optimizations
RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
    CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \
    -trimpath \
    -ldflags="-s -w \
      -X github.com/harmonycloud/opensaola/internal/version.Version=${VERSION} \
      -X github.com/harmonycloud/opensaola/internal/version.GitCommit=${GIT_COMMIT} \
      -X github.com/harmonycloud/opensaola/internal/version.BuildDate=${BUILD_DATE}" \
    -o manager ./cmd

# Download kubectl in builder stage to keep runtime image clean
ARG KUBECTL_VERSION=v1.30.0
RUN curl -LO "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/${TARGETOS}/${TARGETARCH}/kubectl" \
    && curl -LO "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/${TARGETOS}/${TARGETARCH}/kubectl.sha256" \
    && echo "$(cat kubectl.sha256)  kubectl" | sha256sum -c - \
    && chmod 0555 kubectl \
    && rm kubectl.sha256

# Build the architecture-matched saola CLI from the immutable named context.
FROM --platform=$BUILDPLATFORM golang:1.26.4 AS saola-cli-builder

ARG TARGETOS
ARG TARGETARCH
ARG SAOLA_CLI_VERSION
ARG SAOLA_CLI_COMMIT
ARG SAOLA_CLI_SOURCE_DATE_EPOCH

WORKDIR /workspace/saola-cli

COPY --from=saola-cli go.mod go.sum ./
RUN --mount=type=cache,target=/go/pkg/mod \
    go mod download

COPY --from=saola-cli . .
RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
    build_date="$(date -u -d "@${SAOLA_CLI_SOURCE_DATE_EPOCH}" +%Y-%m-%dT%H:%M:%SZ)" \
    && CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \
      -trimpath \
      -ldflags="-s -w \
        -X github.com/harmonycloud/saola-cli/internal/version.Version=${SAOLA_CLI_VERSION} \
        -X github.com/harmonycloud/saola-cli/internal/version.GitCommit=${SAOLA_CLI_COMMIT} \
        -X github.com/harmonycloud/saola-cli/internal/version.BuildDate=${build_date}" \
      -o /workspace/saola ./cmd/saola/

# Runtime image - minimal Alpine with necessary tools (kubectl, curl, jq, sh)
FROM alpine:3.20

# Re-declare build args for OCI labels in runtime stage
ARG VERSION=dev
ARG GIT_COMMIT=unknown
ARG BUILD_DATE=unknown

LABEL org.opencontainers.image.source="https://github.com/harmonycloud/opensaola" \
      org.opencontainers.image.title="opensaola" \
      org.opencontainers.image.description="OpenSaola - Kubernetes Middleware Lifecycle Operator" \
      org.opencontainers.image.licenses="Apache-2.0" \
      org.opencontainers.image.version="${VERSION}" \
      org.opencontainers.image.revision="${GIT_COMMIT}" \
      org.opencontainers.image.created="${BUILD_DATE}"

# Install runtime dependencies and create non-root user in a single layer
# Use --build-arg APK_MIRROR=https://mirrors.tuna.tsinghua.edu.cn/alpine for China acceleration
ARG APK_MIRROR=""
RUN if [ -n "${APK_MIRROR}" ]; then \
      sed -i "s#https\?://dl-cdn.alpinelinux.org/alpine#${APK_MIRROR}#g" /etc/apk/repositories; \
    fi \
    && apk add --no-cache tzdata curl jq \
    && rm -rf /var/cache/apk/* \
    && addgroup -g 65532 -S nonroot \
    && adduser -u 65532 -S -G nonroot nonroot

WORKDIR /app
RUN mkdir -p /app/logs && chown 65532:65532 /app/logs

# Copy binaries from builder
COPY --from=builder --chown=65532:65532 --chmod=0555 /workspace/manager .
COPY --from=builder --chown=65532:65532 --chmod=0555 /workspace/kubectl /usr/bin/kubectl
COPY --from=saola-cli-builder --chown=65532:65532 --chmod=0555 /workspace/saola /usr/local/bin/saola

# Copy only the runtime config file (not dev config)
COPY --chown=65532:65532 pkg/config/config.yaml /app/pkg/config/config.yaml

USER 65532:65532

ENTRYPOINT ["/app/manager"]