Dockerfile

ARG BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:latest

FROM registry.access.redhat.com/ubi9/go-toolset:9.8-1791479310 AS builder

# No .git in the build container, so APP_VERSION/GIT_SHA (embedded via
# -ldflags -X in `make build`, see internal/version) arrive as build-args.
ARG APP_VERSION="0.0.0-dev"
ARG GIT_SHA="unknown"

# Install make as root (UBI9 go-toolset doesn't include it), then switch back to non-root
USER root
RUN dnf install -y make && dnf clean all
WORKDIR /build
RUN chown 1001:0 /build
USER 1001

ENV GOBIN=/build/.gobin
RUN mkdir -p $GOBIN

COPY --chown=1001:0 go.mod go.sum ./
RUN --mount=type=cache,target=/opt/app-root/src/go/pkg/mod,uid=1001 \
    go mod download

COPY --chown=1001:0 . .

RUN --mount=type=cache,target=/opt/app-root/src/go/pkg/mod,uid=1001 \
    --mount=type=cache,target=/opt/app-root/src/.cache/go-build,uid=1001 \
    make build APP_VERSION=${APP_VERSION} GIT_SHA=${GIT_SHA}

# Fail the build if the binary wasn't compiled with FIPS-compliant flags (see container-image-standard.md)
RUN go version -m /build/bin/manager | grep -q "CGO_ENABLED=1" || { echo "FIPS check FAILED: missing CGO_ENABLED=1"; exit 1; }
RUN go version -m /build/bin/manager | grep -q "GOEXPERIMENT=boringcrypto" || { echo "FIPS check FAILED: missing GOEXPERIMENT=boringcrypto"; exit 1; }

# Runtime stage
FROM ${BASE_IMAGE} AS final

WORKDIR /
COPY --from=builder /build/bin/manager .
COPY --from=builder /build/LICENSE /licenses/LICENSE
USER 65532:65532

ARG APP_VERSION="0.0.0-dev"

ENTRYPOINT ["/manager"]

LABEL name="hyperfleet-operator" \
      vendor="Red Hat, Inc." \
      version="${APP_VERSION}" \
      summary="HyperFleet Operator - A Kubernetes operator that packages and delivers HyperFleet." \
      description="A Kubernetes operator that packages and delivers HyperFleet." \
      com.redhat.component="hyperfleet-operator-container" \
      io.k8s.description="A Kubernetes operator that packages and delivers HyperFleet." \
      distribution-scope="public" \
      release="1" \
      url="https://github.com/openshift-hyperfleet/hyperfleet-operator" \
      maintainer="Red Hat HyperFleet Team"