Dockerfile

# ---------------------------------------------------------------------------
# Stage 1: builder
# ---------------------------------------------------------------------------
FROM golang:1.24-alpine AS builder

# Install git (needed for go mod download with private modules, if any)
RUN apk add --no-cache git ca-certificates

WORKDIR /app

# Cache module downloads separately from source changes.
COPY go.mod go.sum* ./
RUN go mod download

# Copy the rest of the source.
COPY . .

# Build the main server binary.
RUN CGO_ENABLED=0 GOOS=linux go build \
    -ldflags="-s -w" \
    -o /out/server \
    ./...

# ---------------------------------------------------------------------------
# Stage 2: minimal runtime image
# ---------------------------------------------------------------------------
FROM alpine:3.21

# Non-root user for security.
RUN addgroup -S appgroup && adduser -S appuser -G appgroup

# ca-certificates is needed for outbound HTTPS calls.
RUN apk add --no-cache ca-certificates tzdata

WORKDIR /app

# Copy compiled binary from builder.
COPY --from=builder /out/server /server

# Drop privileges.
USER appuser

EXPOSE 3000

CMD ["/server"]