# ★ FORK (2026-10-02): the image the estate deployer builds and runs.
#
# zestate's container deployer (estate-deploy, design §6.6 / §7.3 rule 5) builds
# THIS file — never `Dockerfile`, which stays as upstream wrote it plus the
# 2026-09-22 tag fix — from `git archive` of a merged commit, in rootless podman
# on znix, and pushes it to forgejo.matthewzeman.net/ops/glance:<sha12>. zmedia
# then runs it by @sha256 digest. What rule 5 asks of it, and where it is:
#
#   FROM pinned by digest   both stages, below (the tag is kept for the reader;
#                           the digest is what is pulled). Bump BOTH together.
#   USER not root           10001:10001, numeric so no passwd entry is needed
#   EXPOSE = deploy.port    8080 (estate.yaml deploy.port)
#   HEALTHCHECK             GET /api/healthz on loopback, busybox wget
#   no custom frontend      no `# syntax=` line; no socket, no bind mounts
#
# ★ THE AGPL SOURCE OFFER (§15, D18) IS KEPT. The deployer writes
# build/source.tar.gz from the same commit it archives the context from
# (estate.yaml build.source_offer), as zeman-build-image.sh does by hand. A build
# without it FAILS at the COPY rather than shipping an image whose /source.tar.gz
# answers 503.
#
# ★ NON-ROOT AND THE MOUNTS (measured on zmedia 2026-10-02): config/ and assets/
# are world-readable (2755 root, files 664), the wallpapers share is 2775
# mzeman:users with 664 files — all readable by uid 10001. The filing token
# /root/secrets/glance-ember.token is 0600 root and is NOT; see the
# glance-dashboard compose file for how that one file is granted.
#
# golang:1.27.1-alpine3.24 index digest, read from Docker Hub 2026-10-02.
FROM docker.io/library/golang:1.27.1-alpine3.24@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS builder

WORKDIR /app
COPY . /app
ARG GLANCE_VERSION=dev
RUN CGO_ENABLED=0 go build -ldflags "-s -w -X github.com/glanceapp/glance/internal/glance.buildVersion=${GLANCE_VERSION}" .

# alpine:3.24.1 index digest, read from Docker Hub 2026-10-02.
FROM docker.io/library/alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b

WORKDIR /app
# Owned by root and not writable by the runtime user: Glance writes nothing to
# /app, and an image whose binary its own process can replace is not one to run.
COPY --from=builder /app/glance /app/glance
COPY build/source.tar.gz /app/source.tar.gz

USER 10001:10001
EXPOSE 8080/tcp
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
    CMD wget -q -O /dev/null http://127.0.0.1:8080/api/healthz || exit 1
ENTRYPOINT ["/app/glance", "--config", "/app/config/glance.yml"]
