FROM golang:1.26.6-alpine@sha256:3889b425f035be855a72fb4755265311293b6d414521f0a519d819df32222d83 AS build
WORKDIR /src
COPY go.mod go.sum go.work go.work.sum ./
COPY cmd ./cmd
COPY internal ./internal
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/pulse-agent ./cmd/agent

FROM alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce
RUN addgroup -S -g 65532 pulse && adduser -S -D -H -u 65532 -G pulse pulse
COPY --from=build /out/pulse-agent /usr/local/bin/pulse-agent
COPY deploy/pulse-entrypoint.sh /usr/local/bin/pulse-entrypoint.sh
COPY deploy/healthcheck-heartbeat.sh /usr/local/bin/pulse-healthcheck.sh
RUN chmod 0755 /usr/local/bin/pulse-entrypoint.sh /usr/local/bin/pulse-healthcheck.sh
# Mount points for the read-only host procfs/sysfs bind mounts declared in
# deploy/compose.yaml. They are created in the image so the destinations exist under
# read_only: true and so the image documents the only host access the agent has.
RUN mkdir -p /host/proc /host/sys && chmod 0555 /host /host/proc /host/sys
USER 65532:65532
# Heartbeat contract: docs/operations/WORKER_AGENT_HEALTHCHECK_CONTRACT.md
HEALTHCHECK --interval=15s --timeout=5s --start-period=20s --retries=3 CMD ["/usr/local/bin/pulse-healthcheck.sh"]
ENTRYPOINT ["/usr/local/bin/pulse-entrypoint.sh", "/usr/local/bin/pulse-agent"]