FROM golang:1.26-alpine AS build

WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -o /out/codevault .

FROM alpine:3.20

RUN apk add --no-cache ca-certificates
WORKDIR /app
COPY --from=build /out/codevault ./codevault

# /app/data's ownership is picked up by Docker as the initial content of any
# named volume mounted there, so the "nobody" user can still write the DB file.
RUN mkdir -p /app/data && chown -R nobody:nobody /app/data
USER nobody

EXPOSE 8080

ENTRYPOINT ["./codevault"]
CMD ["run", "--config", "/app/config.yaml"]