api/Dockerfile.admin-cli at main · openctemio/api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
# =============================================================================
# Admin CLI Dockerfile
# Builds openctem-admin and bootstrap-admin CLI tools
# =============================================================================

# -----------------------------------------------------------------------------
# Builder stage
# -----------------------------------------------------------------------------
FROM public.ecr.aws/docker/library/golang:1.26.5-alpine AS builder

WORKDIR /app

# Install dependencies
RUN apk add --no-cache git ca-certificates tzdata

# Set GOPRIVATE for private modules
ENV GOPRIVATE=github.com/openctemio/*

# Copy go mod files
COPY go.mod go.sum ./

# Download dependencies
RUN go mod download

# Copy source code
COPY . .

ARG TARGETOS=linux
ARG TARGETARCH=amd64
ARG VERSION=dev

# Disable workspace mode (GOWORK=off) to build standalone
ENV GOWORK=off

# Build openctem-admin CLI
RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
    go build -trimpath \
    -ldflags="-s -w -X main.Version=${VERSION}" \
    -o /out/openctem-admin \
    ./cmd/openctem-admin

# Build bootstrap-admin CLI
RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
    go build -trimpath \
    -ldflags="-s -w" \
    -o /out/bootstrap-admin \
    ./cmd/bootstrap-admin

# -----------------------------------------------------------------------------
# Production stage - Minimal distroless image
# -----------------------------------------------------------------------------
FROM gcr.io/distroless/static-debian12:nonroot AS production

LABEL org.opencontainers.image.title="OpenCTEM Admin CLI"
LABEL org.opencontainers.image.description="kubectl-style CLI for OpenCTEM platform administration"
LABEL org.opencontainers.image.source="https://github.com/openctemio/api"

# Copy binaries
COPY --from=builder /out/openctem-admin /usr/local/bin/openctem-admin
COPY --from=builder /out/bootstrap-admin /usr/local/bin/bootstrap-admin

# Copy timezone data and CA certs
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt

# Run as non-root user (65532 is the nonroot user in distroless)
USER 65532:65532

# CLI tools are short-lived, disable HEALTHCHECK
HEALTHCHECK NONE

# Default to openctem-admin
ENTRYPOINT ["/usr/local/bin/openctem-admin"]
CMD ["--help"]