FROM golang:1.26-alpine AS builder

# Fail rather than download a toolchain: the base image must already satisfy the
# go directive in go.mod so the build stays hermetic (no network at build time).
ENV GOTOOLCHAIN=local

WORKDIR /build

# Dependencies are vendored, so the build needs no module network access or
# credentials (the cephrgw-operator dep lives in a private Gitea repo).
COPY . .

RUN CGO_ENABLED=0 go build -mod=vendor -ldflags="-s -w" -o autobackup-operator ./cmd/operator

FROM gcr.io/distroless/static-debian12:nonroot

COPY --from=builder /build/autobackup-operator /usr/local/bin/autobackup-operator

ENTRYPOINT ["autobackup-operator"]