chore: build

backend/Dockerfile

@@ -0,0 +1,50 @@
+# syntax=docker/dockerfile:1
+
+# --- Build stage -------------------------------------------------------
+# golang:1.26 matches the "go 1.26.0" directive in go.mod (GOTOOLCHAIN=auto
+# would otherwise re-download the right toolchain anyway, but pinning here
+# keeps builds hermetic and fast).
+FROM golang:1.26-alpine AS builder
+
+WORKDIR /src
+
+# Cache deps in their own layer.
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod \
+    go mod download
+
+COPY . .
+
+# CGO disabled -> static binary, runs on the scratch-ish alpine base below
+# with no libc surprises. Both entrypoints are built from the same module:
+# cmd/api is the long-running server, cmd/seed is the one-shot admin
+# bootstrap job (see charts/backend/templates/seed-job.yaml).
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/api ./cmd/api && \
+    CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/seed ./cmd/seed
+
+# --- Runtime stage -------------------------------------------------------
+FROM alpine:3.20
+
+RUN apk add --no-cache ca-certificates tzdata && \
+    addgroup -S app && adduser -S app -G app
+
+WORKDIR /app
+
+COPY --from=builder /out/api /out/seed ./
+# Migrations are baked into the image so the migration Job (see
+# charts/backend/templates/migration-job.yaml) always runs the set that
+# matches the running server, without needing a separate artifact.
+COPY --from=builder /src/migrations ./migrations
+
+# Local-disk media storage (MEDIA_STORAGE_DRIVER=local) writes here; the
+# chart mounts a PVC at this path when persistence is enabled. Owned by the
+# non-root "app" user created above.
+RUN mkdir -p /app/uploads /app/verification-uploads && \
+    chown -R app:app /app
+
+USER app
+EXPOSE 8080
+
+ENTRYPOINT ["/app/api"]