# --- build -----------------------------------------------------------------
# Static Go binary so the runtime image can be distroless (no shell, tiny,
# minimal attack surface). pgx is pure Go, so CGO can be disabled.
FROM golang:1.26 AS build
WORKDIR /src

# Cache modules separately from source for faster rebuilds.
COPY go.mod go.sum ./
RUN go mod download

COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/api ./cmd/api

# --- runtime ---------------------------------------------------------------
FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=build /out/api /api
EXPOSE 8080
# Config comes from the environment (DB_HOST, DB_PASSWORD, PORT, …), set by
# docker-compose. No .env file is baked into the image.
ENTRYPOINT ["/api"]