Dockerfile.sentinel

# ─── Stage 1: Builder ────────────────────────────────────────────────────────
FROM golang:1.24.5-alpine3.21 AS builder
ARG VERSION=dev
ARG COMMIT=unknown
WORKDIR /app
RUN apk add --no-cache ca-certificates git
COPY go.mod go.sum ./
RUN go mod download && go mod verify
COPY . .
WORKDIR /app/sentinel
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
    go build \
      -ldflags="-s -w -X main.Version=${VERSION} -X main.Commit=${COMMIT}" \
      -trimpath \
      -o /out/sentinel \
      .

# ─── Stage 2: Runtime ────────────────────────────────────────────────────────
FROM alpine:3.21
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
WORKDIR /app
RUN addgroup -g 1001 -S gophergroup && \
    adduser  -u 1001 -S gopheruser -G gophergroup
COPY --from=builder /out/sentinel ./sentinel
RUN chown gopheruser:gophergroup /app/sentinel
USER gopheruser
EXPOSE 2113

# Sentinel is a background agent with no inbound HTTP port.
# HEALTHCHECK uses kill -0 1: succeeds as long as PID 1 (the entrypoint)
# is alive. Avoids pgrep -x name-matching issues on BusyBox/Alpine where
# the full command path (/app/sentinel) doesn't match the bare name.
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD kill -0 1 || exit 1

ENTRYPOINT ["/app/sentinel"]