# syntax=docker/dockerfile:1.6
#
# mule-sidecar — Go service for endpoints PhotoPrism does not expose.
# Multi-stage build: a Go toolchain image compiles a static binary,
# then we copy it onto a distroless base so the runtime image is ~12 MB
# with no shell, package manager, or libc.

FROM docker.io/library/golang:1.25-alpine AS build
WORKDIR /src

# Cache deps separately from source so a one-line code change doesn't
# re-download the whole module graph.
COPY go.mod go.sum ./
RUN go mod download

COPY . ./
# CGO disabled → fully static binary that runs on the distroless base
# (no libc resolution at startup). -trimpath strips local paths from
# debug info; -s -w drop the symbol table to keep the binary small.
RUN CGO_ENABLED=0 GOOS=linux go build \
    -trimpath \
    -ldflags='-s -w' \
    -o /out/mule-sidecar .

FROM gcr.io/distroless/static-debian12:latest
COPY --from=build /out/mule-sidecar /mule-sidecar
EXPOSE 8000
ENTRYPOINT ["/mule-sidecar"]