Dockerfile.cicd

# Dockerfile.cicd - Optimized for CI/CD with pre-built binaries
FROM alpine:3.20

LABEL org.opencontainers.image.source=https://github.com/thand-io/agent
LABEL org.opencontainers.image.description="Thand Agent - Open-source agent for AI-ready privilege access management (PAM) and just-in-time access (JIT) to cloud infrastructure, SaaS applications and local systems."
LABEL org.opencontainers.image.licenses=BSL-1.1

# Set up build arguments
ARG TARGETARCH
ARG VERSION=dev
ARG COMMIT=unknown

# Install ca-certificates for HTTPS calls
RUN apk update && apk --no-cache add ca-certificates gcompat

# Create a non-root user
RUN addgroup -S thand && adduser -S thand -G thand

# Set working directory
WORKDIR /app

# Copy pre-built binary based on target architecture
COPY dist/agent-linux-${TARGETARCH} ./thand

# Make binary executable
RUN chmod +x ./thand

# Copy configuration example file if it exists
COPY config.example.yaml ./

# Change ownership to non-root user
RUN chown -R thand:thand /app

# Switch to non-root user
USER thand

# Expose the default port (adjust if your server uses a different port)
EXPOSE 8080

# Health check (adjust the endpoint as needed)
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://localhost:8080/health || exit 1

ENV THAND_SERVER_PORT=8080

# Default command is to run the server
CMD ["./thand", "server"]