pubsub/Dockerfile

# syntax=docker/dockerfile:1
FROM --platform=$BUILDPLATFORM golang:1.27.1-alpine AS builder
# go.mod pins the toolchain. The golang base image sets GOTOOLCHAIN=local,
# which turns a `go` directive newer than the image into a hard build
# failure instead of a download.
ENV GOTOOLCHAIN=auto

ARG VERSION="dev"
ARG GIT_COMMIT

ARG TARGETOS
ARG TARGETARCH

ENV GOOS=$TARGETOS \
    GOARCH=$TARGETARCH \
    GO111MODULE=on \
    CGO_ENABLED=0

RUN apk add --no-cache ca-certificates && update-ca-certificates

WORKDIR /src
COPY go.mod go.sum ./
RUN --mount=type=cache,target=/go/pkg/mod \
    go mod download

COPY . /src

RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
    go build -trimpath \
    -ldflags "-w -X server.serverVersion=${VERSION} -X server.gitCommit=${GIT_COMMIT}" \
    -o /out/pubsub .

FROM alpine:3.22 AS root
RUN apk add --no-cache ca-certificates tzdata && \
    mkdir -p /pubsub/conf /data && \
    chown -R 65532:65532 /pubsub /data

FROM scratch

LABEL org.opencontainers.image.title="Hanzo PubSub"
LABEL org.opencontainers.image.description="NATS-compatible pub/sub messaging — Hanzo PubSub"
LABEL org.opencontainers.image.vendor="Hanzo AI"
LABEL org.opencontainers.image.source="https://github.com/hanzoai/pubsub"

COPY --from=root /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=root /usr/share/zoneinfo /usr/share/zoneinfo
COPY --from=root --chown=65532:65532 /data /data
COPY --from=root --chown=65532:65532 /pubsub /pubsub
COPY docker/nats-server.conf                  /pubsub/conf/server.conf
COPY --from=builder /out/pubsub               /bin/pubsub

USER 65532:65532
EXPOSE 4222 8222 6222 5222

ENTRYPOINT ["/bin/pubsub"]
CMD ["-c", "/pubsub/conf/server.conf"]