From b5e68da27051b67851c3bdaab6fca07696d5e087 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sun, 27 Sep 2026 00:26:14 +1000
Subject: [PATCH] Add container image build

Ship a distroless image so the plugin can run in-cluster in serve mode,
letting developer laptops use the shared cache without S3 credentials.

- Dockerfile: golang builder running `make build`, distroless static nonroot
- `make docker` for a local smoke build
- `.woodpecker/docker.yaml` pushes to docker-internal on tag
- README: image name and the SSL_CERT_DIR mount the internal CA needs
---
 .woodpecker/docker.yaml | 28 ++++++++++++++++++++++++++++
 Dockerfile              | 19 +++++++++++++++++++
 Makefile                |  8 +++++++-
 README.md               | 22 +++++++++++++++++++++-
 4 files changed, 75 insertions(+), 2 deletions(-)
 create mode 100644 .woodpecker/docker.yaml
 create mode 100644 Dockerfile

diff --git a/.woodpecker/docker.yaml b/.woodpecker/docker.yaml
new file mode 100644
index 0000000..d691300
--- /dev/null
+++ b/.woodpecker/docker.yaml
@@ -0,0 +1,28 @@
+when:
+  - event: tag
+    ref: refs/tags/v*
+
+steps:
+  - name: docker
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
+    settings:
+      registry: artifactapi.k8s.syd1.au.unkin.net
+      repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/go-cache-plugin
+      dockerfile: Dockerfile
+      platforms: linux/amd64
+      buildkit_config: |
+        [registry."artifactapi.k8s.syd1.au.unkin.net"]
+          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
+      tags:
+        - ${CI_COMMIT_TAG}
+        - latest
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 2Gi
+            cpu: 2
+          limits:
+            memory: 6Gi
+            cpu: 4
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..a56b889
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,19 @@
+FROM docker.io/golang:1.26 AS builder
+
+WORKDIR /build
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+RUN make build
+
+# distroless static ships /etc/ssl/certs/ca-certificates.crt, which the S3
+# client needs to reach https://s3.ceph.unkin.net, and runs as an unprivileged
+# user. No shell, no package manager.
+FROM gcr.io/distroless/static-debian12:nonroot
+
+COPY --from=builder /build/dist/go-cache-plugin /usr/local/bin/go-cache-plugin
+
+ENTRYPOINT ["go-cache-plugin"]
diff --git a/Makefile b/Makefile
index 86c62e3..8dd0b50 100644
--- a/Makefile
+++ b/Makefile
@@ -3,12 +3,14 @@ BINARY   := go-cache-plugin
 # pinned by the tool directive in go.mod.
 PKG      := github.com/tailscale/go-cache-plugin/cmd/go-cache-plugin
 DIST     := dist
+IMAGE    := artifactapi.k8s.syd1.au.unkin.net/docker-internal/$(BINARY)
+VERSION  := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
 UPSTREAM := $(shell go list -m -f '{{.Version}}' github.com/tailscale/go-cache-plugin)
 LDFLAGS  := -s -w
 OS       ?= $(shell go env GOOS)
 ARCH     ?= $(shell go env GOARCH)
 
-.PHONY: all build test lint fmt pre-commit clean upstream patch minor major _tag
+.PHONY: all build test lint fmt pre-commit docker clean upstream patch minor major _tag
 
 all: build
 
@@ -30,6 +32,10 @@ fmt:
 pre-commit:
 	uvx pre-commit run --all-files
 
+# Local smoke test only; the tag pipeline builds and pushes the real image.
+docker:
+	docker build -t $(IMAGE):$(VERSION) .
+
 upstream:
 	@echo $(UPSTREAM)
 
diff --git a/README.md b/README.md
index 669a068..4975a05 100644
--- a/README.md
+++ b/README.md
@@ -42,6 +42,25 @@ exit, and `--expiry` to age entries out.
 For a shared cache daemon, run `go-cache-plugin serve --plugin <port>` once and
 have each build use `go-cache-plugin connect <port>` as its `GOCACHEPROG`.
 
+## Container image
+
+`artifactapi.k8s.syd1.au.unkin.net/docker-internal/go-cache-plugin`, built and
+pushed on tag. Distroless static, nonroot, no shell. `make docker` builds it
+locally.
+
+The image carries only the public CA bundle, so a `serve`-mode Deployment must
+mount the internal CA and point Go at it:
+
+```yaml
+env:
+  - name: SSL_CERT_DIR
+    value: /etc/ssl/internal
+```
+
+`s3.ceph.unkin.net` is issued by `unkin.net Intermediate Authority`; without
+that mount the S3 client fails with `x509: certificate signed by unknown
+authority`.
+
 ## CI
 
 Woodpecker steps fetch the released binary:
@@ -55,4 +74,5 @@ commands:
 ## Release
 
 `make patch|minor|major` tags and pushes; the tag pipeline builds
-`linux/amd64` and `linux/arm64` and attaches them with `sha256sums.txt`.
+`linux/amd64` and `linux/arm64`, attaches them with `sha256sums.txt`, and
+pushes the container image tagged with the git tag and `latest`.