FROM golang:1.23-alpine AS build
WORKDIR /src

# Resolve dependencies before copying source. Do not run `go mod tidy` here.
COPY go.mod go.sum ./
RUN go mod download

COPY cmd ./cmd
COPY internal ./internal

RUN CGO_ENABLED=0 GOOS=linux go build \
    -trimpath -ldflags="-s -w" \
    -o /out/neuralhunt-service-controller ./cmd/service-controller

FROM alpine:3.21
RUN apk add --no-cache ca-certificates \
 && mkdir -p /app
WORKDIR /app

COPY --from=build /out/neuralhunt-service-controller /app/neuralhunt-service-controller

# docker.sock access normally requires root. Prefer a Docker Socket Proxy in
# production and point DOCKER_HOST at it if you want to run this process with a
# less privileged container user.
USER root
EXPOSE 8101 8102
ENTRYPOINT ["/app/neuralhunt-service-controller"]