37 lines
1.1 KiB
Docker
37 lines
1.1 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# --- build stage ---------------------------------------------------------
|
|
FROM golang:1.25 AS builder
|
|
|
|
WORKDIR /src
|
|
|
|
# Cache module downloads.
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
|
|
# Static, stripped binary — no CGO so it runs on distroless/scratch.
|
|
ARG VERSION=dev
|
|
ARG REVISION=unknown
|
|
RUN CGO_ENABLED=0 GOOS=linux go build \
|
|
-trimpath \
|
|
-ldflags="-s -w -X main.version=${VERSION} -X main.revision=${REVISION}" \
|
|
-o /predictor ./cmd/predictor
|
|
|
|
# --- runtime stage -------------------------------------------------------
|
|
# distroless/static:nonroot ships CA certificates (needed for TLS to the
|
|
# NOAA S3 mirror) and runs as uid:gid 65532:65532.
|
|
FROM gcr.io/distroless/static-debian12:nonroot AS runtime
|
|
|
|
COPY --from=builder /predictor /predictor
|
|
|
|
# Default data dir; mount a node-local volume here in production.
|
|
ENV PREDICTOR_DATA_DIR=/data
|
|
EXPOSE 8080
|
|
|
|
# Liveness probe via the binary itself — no shell/curl in the image.
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=120s --retries=3 \
|
|
CMD ["/predictor", "-healthcheck"]
|
|
|
|
ENTRYPOINT ["/predictor"]
|