# Build stage
# Pinned to a supported Go release. Go 1.23 left the upstream support window,
# so the image shipped without stdlib security fixes. Flagged by the 2026-09
# security audit; the project moved to 1.27 in the same pass.
FROM golang:1.27.1-alpine AS builder

# Install build dependencies
RUN apk add --no-cache gcc musl-dev

# Set working directory
WORKDIR /app

# Copy go.mod and go.sum files
COPY go.mod go.sum ./

# Download dependencies
RUN go mod download

# Copy the source code
COPY . .

# Build the application
RUN CGO_ENABLED=1 GOOS=linux go build -a -tags musl -o member-console .

# Runtime stage
# Pinned rather than floating: `alpine:latest` made builds irreproducible and
# silently changed the runtime base. Bump this tag deliberately.
FROM alpine:3.23

# Run as a dedicated non-root user; port 8080 is unprivileged and the app
# performs no runtime filesystem writes, so no ownership setup is needed.
RUN adduser -D -H -u 65532 app

# Set the working directory
WORKDIR /app

# Copy the binary from the builder stage
COPY --from=builder /app/member-console .

USER app

# Set environment variables
ENV PORT=8080 \
    ENV=production

# Expose the port the app runs on
EXPOSE 8080

# Command to run the application
ENTRYPOINT ["/app/member-console"]
CMD ["start"]