FROM golang:1.25-alpine AS builder

RUN apk add --no-cache git ca-certificates

WORKDIR /src

COPY go.mod go.sum ./
RUN go mod download

COPY . .
RUN CGO_ENABLED=0 go build -tags modernc -ldflags="-s -w" -o /out/knot ./cmd/knot
RUN CGO_ENABLED=0 go build -tags modernc -ldflags="-s -w" -o /out/aerie-entrypoint ./deploy/cloudflare/cmd/aerie-entrypoint
RUN go install github.com/google/go-licenses@latest
RUN go-licenses report ./cmd/knot ./deploy/cloudflare/cmd/aerie-entrypoint > /out/THIRD_PARTY_LICENSES

FROM alpine:3.21

RUN apk add --no-cache ca-certificates git fuse3

RUN apk add --no-cache curl \
 && curl -fsSL -o /tmp/tigrisfs.tar.gz https://github.com/tigrisdata/tigrisfs/releases/download/v1.2.1/tigrisfs_1.2.1_linux_amd64.tar.gz \
 && echo "9fd6e7a9f3e7d86571ea55c66459205e94dfa5f6a25887d7e95c0a46f7641ed4  /tmp/tigrisfs.tar.gz" | sha256sum -c - \
 && tar -xzf /tmp/tigrisfs.tar.gz -C /usr/local/bin tigrisfs \
 && chmod 0755 /usr/local/bin/tigrisfs \
 && rm /tmp/tigrisfs.tar.gz \
 && apk del curl

COPY --from=builder /out/knot /usr/local/bin/knot
COPY --from=builder /out/aerie-entrypoint /usr/local/bin/aerie-entrypoint
COPY --from=builder /out/THIRD_PARTY_LICENSES /usr/local/share/THIRD_PARTY_LICENSES

RUN mkdir -p /home/git /var/lib/knot /var/lib/knot/maintenance

WORKDIR /var/lib/knot

EXPOSE 5555

# Operational note: env-only `wrangler deploy` changes (e.g. new container env
# vars via worker.js) do NOT recycle warm container instances — only an image
# change rolls them. Bump this marker to force a roll when applying new env.
LABEL org.solpbc.aerie.deploy-marker="260705-upstream-catchup"

ENTRYPOINT ["/usr/local/bin/aerie-entrypoint"]
