# syntax=docker/dockerfile:1.7
FROM golang:1.25-alpine AS build
WORKDIR /src
ARG VERSION=dev
ARG COMMIT=dev
ARG BUILD_DATE=unknown
COPY go.mod ./
RUN --mount=type=cache,target=/go/pkg/mod go mod download
COPY . .
RUN test -f ./cmd/dockwatch/main.go && test -f ./internal/stacks/stacks.go && test -f ./internal/hostsecurity/security.go && test -f ./internal/hostsecurity/firewall_provider.go && test -f ./web/embed.go || \
    (echo "ERROR: required source files are missing from Docker build context; check .dockerignore" >&2; exit 1)
# Keep the module graph in sync with the actual source tree. This is required for
# Go 1.17+ module graph pruning when transitive dependencies must be recorded as
# indirect requirements in go.mod. The project intentionally has no vendored deps.
RUN --mount=type=cache,target=/go/pkg/mod \
    go mod tidy
RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build \
    CGO_ENABLED=0 GOOS=linux go build -trimpath \
    -ldflags="-s -w -X git.send.nrw/sendnrw/dockwatch/internal/buildinfo.Version=${VERSION} -X git.send.nrw/sendnrw/dockwatch/internal/buildinfo.Commit=${COMMIT} -X git.send.nrw/sendnrw/dockwatch/internal/buildinfo.Date=${BUILD_DATE}" \
    -o /out/dockwatch ./cmd/dockwatch

FROM docker:cli
ENV DOCKER_CONFIG=/data/docker-config
RUN apk add --no-cache ca-certificates tzdata git openssh-client acl util-linux
COPY --from=build /out/dockwatch /usr/local/bin/dockwatch
VOLUME ["/data","/stacks"]
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD wget -q -O /dev/null http://127.0.0.1:8080/healthz || exit 1
ENTRYPOINT ["/usr/local/bin/dockwatch"]