FROM golang:1.26.2 AS build

WORKDIR /code

COPY go.mod ./
RUN go mod download

COPY . .
RUN CGO_ENABLED=0 go build -v -ldflags="-s -w" -o /usr/bin/app ./...

# Empty cache dir; ownership is set during COPY into the final stage so the
# distroless `nonroot` user (uid 65532) can write to it without an external
# volume mount.
RUN mkdir -p /cache

FROM gcr.io/distroless/static:nonroot
EXPOSE 8080
COPY --from=build /usr/bin/app /app
COPY --from=build --chown=65532:65532 /cache /var/cache/pz8-relay
VOLUME /var/cache/pz8-relay
ENTRYPOINT ["/app"]