# 两阶段构建 + artifact 导出层(build stage 交叉编译,多平台构建无需 QEMU):
#   镜像:   docker build -t oci-portal .
#   二进制: docker buildx build --platform linux/amd64,linux/arm64 --target artifact \
#             --output type=local,dest=./output .   # 产物在 output/linux_{amd64,arm64}/
#
# 完整产物需先把前端 dist 放进 internal/webui/dist(否则嵌入的是占位页):
#   本地: 前端仓库 npm run build 后拷入,或从前端 Release 下载 dist.zip 解压
#   CI:  release.yml 从前端仓库 latest Release 下载 dist.zip(见 .gitea/.github workflows)

# stage 1: 后端(嵌入 dist);跑在构建机原生平台上交叉编译,多平台构建无需 QEMU
FROM --platform=$BUILDPLATFORM golang:1.26-alpine AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . ./
ARG TARGETOS TARGETARCH
RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \
  go build -trimpath -ldflags "-s -w" -o /oci-portal-server ./cmd/server

# artifact: 仅承载二进制,供 buildx --output type=local 导出(release 流程用)
FROM scratch AS artifact
COPY --from=build /oci-portal-server /oci-portal-server

# stage 2: 运行层(distroless/static 自带系统 CA,OCI API 的 HTTPS 依赖它;nonroot 用户)
FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=build /oci-portal-server /oci-portal-server
# SQLite 数据卷;DB_PATH 指向卷内路径(见 docker-compose.yml)
VOLUME ["/data"]
EXPOSE 8080
# distroless 无 shell,探活用二进制自检 flag
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
  CMD ["/oci-portal-server", "-healthcheck"]
ENTRYPOINT ["/oci-portal-server"]