From 818c9881be4b0203baa0f4373995d506136812bd Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Wed, 19 Aug 2026 22:18:40 -0700
Subject: [PATCH] build: cross-compile the image to the target arch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Build stage pinned to BUILDPLATFORM and GOARCH driven by TARGETARCH, so an
amd64 image builds natively from an arm64 workstation instead of running the
Go toolchain under QEMU. TARGETARCH defaults to amd64 — every cluster node is
amd64, and a plain docker build on arm64 would otherwise produce an image the
nodes cannot run.
---
 Dockerfile | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 6017cda..5d7d6e7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,7 +4,10 @@
 # That is deliberate — see tasks/6.1-hardened-image.md. It also means the binary
 # must be fully static, hence CGO_ENABLED=0.
 
-FROM golang:1.25-bookworm AS build
+# --platform=$BUILDPLATFORM pins the build stage to the machine doing the
+# building, then Go cross-compiles to $TARGETARCH. Without it, building an
+# amd64 image from an arm64 workstation runs the whole toolchain under QEMU.
+FROM --platform=$BUILDPLATFORM golang:1.25-bookworm AS build
 
 WORKDIR /src
 
@@ -15,13 +18,17 @@ RUN go mod download
 
 COPY . .
 
-# VERSION is stamped in by CI as the commit SHA so a running pod can be traced
-# back to an exact commit.
+# VERSION is stamped in so a running pod can be traced back to an exact build.
 ARG VERSION=dev
 
+# TARGETARCH is supplied by buildx from --platform. Defaulted to amd64 because
+# every node in the cluster is amd64; a plain `docker build` on an arm64
+# workstation would otherwise silently produce an unrunnable image.
+ARG TARGETARCH=amd64
+
 # -trimpath strips local filesystem paths from the binary.
 # -w -s drop DWARF and the symbol table; nothing debugs off the production image.
-RUN CGO_ENABLED=0 GOOS=linux go build \
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build \
       -trimpath \
       -ldflags="-w -s -X main.version=${VERSION}" \
       -o /out/gateway ./cmd/gateway