Dockerfile.fips

FROM mcr.microsoft.com/oss/go/microsoft/golang:1.23.6-fips-cbl-mariner2.0 AS builder

ENV GOPATH=/go \
    PATH=/usr/local/go/bin:/go/bin:/usr/local/bin:/usr/bin:$PATH \
    CGO_ENABLED=1 \
    FIPS_ENABLED=1

RUN mkdir -p /go && \
    tdnf install -y \
        ca-certificates \
        build-essential \
        openssl-devel \
        gcc \
        shadow-utils && \
    tdnf clean all

WORKDIR /app
COPY . .

ARG LD_FLAGS

ARG TARGETARCH
RUN GOOS=linux GOARCH=$TARGETARCH \
    BUILD_TAGS=fips GOEXPERIMENT=systemcrypto \
    CGO_ENABLED=1 FIPS_ENABLED=1 \
    go build -p 1  -ldflags="-s -w" -o /app/reports-server ./

RUN groupadd --system appgroup && \
    useradd --system --uid 1001 --gid appgroup --home-dir /nonexistent --shell /usr/sbin/nologin appuser && \
    chown appuser:appgroup /app/reports-server

FROM mcr.microsoft.com/cbl-mariner/distroless/base:2.0-nonroot

COPY --from=builder /etc/passwd /etc/passwd

COPY --from=builder /etc/group /etc/group

COPY --from=builder /app/reports-server /reports-server

COPY --from=builder /etc/ssl/certs /etc/ssl/certs

USER 1001

ENTRYPOINT ["/reports-server"]