FROM golang:1.26-alpine AS build
WORKDIR /src

# Resolve dependencies before copying source. Do not run `go mod tidy` here.
COPY go.mod go.sum ./
RUN go mod download

COPY cmd ./cmd
COPY internal ./internal

RUN CGO_ENABLED=0 GOOS=linux go build \
    -trimpath -ldflags="-s -w" \
    -o /out/neuralhunt-client ./cmd/client

FROM alpine:3.24
RUN apk add --no-cache su-exec \
 && adduser -D -h /home/app app \
 && mkdir -p /app /identity \
 && chown -R app:app /app /identity
WORKDIR /app

COPY --from=build /out/neuralhunt-client /app/neuralhunt-client
COPY docker/worker-entrypoint.sh /usr/local/bin/neuralhunt-worker-entrypoint
RUN chmod 0555 /usr/local/bin/neuralhunt-worker-entrypoint

# The entrypoint starts as root only long enough to normalize ownership of the
# named identity volume. It immediately execs the client as the unprivileged
# `app` user. Customer Service grants only the bootstrap capabilities required
# for this transition (CHOWN, DAC_OVERRIDE, SETUID, SETGID).
USER root
ENV HOME=/home/app
VOLUME ["/identity"]
ENTRYPOINT ["/usr/local/bin/neuralhunt-worker-entrypoint"]
CMD ["-help"]