# Build stage. The controller has no cgo and no runtime assets, so the final image
# is a static binary on a base with no shell.
FROM golang:1.26 AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/controller .

FROM gcr.io/distroless/static:nonroot
COPY --from=build /out/controller /usr/local/bin/controller
USER 65532:65532
ENTRYPOINT ["/usr/local/bin/controller"]