Dockerfile-openshift

# Stage 1: Install dependencies with root privileges
FROM registry.access.redhat.com/ubi9/go-toolset AS builder-deps
USER root

# Install system dependencies first - rarely changes
RUN dnf install -y --allowerasing --setopt=tsflags=nodocs \
    curl \
    autoconf \
    automake \
    libtool \
    pkgconfig \
    gcc \
    gcc-c++ \
    make \
    git \
    && dnf clean all

# Install libpostal with models - rarely changes
RUN git clone https://github.com/openvenues/libpostal && \
    cd libpostal && \
    ./bootstrap.sh && \
    ./configure --prefix=/usr/local && \
    make -j4 && \
    make install && \
    mkdir -p /usr/local/share/libpostal

# Download libpostal data - separate step for better caching
RUN cd libpostal/src && \
    PATH=$PATH:/usr/local/bin ./libpostal_data download all /usr/local/share/libpostal

# Set permissions - should be last in this stage
RUN chown -R 1001:0 /usr/local && \
    chmod -R g=u /usr/local

# Stage 2: Build the application
FROM registry.access.redhat.com/ubi9/go-toolset AS builder
ARG VERSION
WORKDIR /opt/app-root/src/

# Copy only the necessary files from builder-deps
COPY --from=builder-deps /usr/local /usr/local
COPY --from=builder-deps /usr/lib64 /usr/lib64

# Set environment variables for build
ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig
ENV LD_LIBRARY_PATH=/usr/local/lib

# Copy go.mod and go.sum first to cache dependencies
COPY go.mod go.sum ./
RUN go mod download

# Copy source files
COPY . .

# Create bin directory and set permissions BEFORE building
USER root
RUN mkdir -p bin && \
    chown -R 1001:0 . && \
    chmod -R g=u .

USER 1001
RUN VERSION=${VERSION} GOTAGS="-tags libpostal" make build-server

# Stage 4: Final stage
FROM registry.access.redhat.com/ubi9/ubi-minimal:9.5-1733767867
ARG VERSION=unknown
LABEL maintainer="Moov <oss@moov.io>"
LABEL name="watchman"
LABEL version=$VERSION

# Install runtime dependencies
USER root
RUN microdnf install -y \
    libstdc++ \
    && microdnf clean all

# Copy libpostal files and setup
COPY --from=builder-deps /usr/local /usr/local
ENV LD_LIBRARY_PATH=/usr/local/lib

# Copy application files
COPY --from=builder /opt/app-root/src/bin/server /bin/server

# Set final permissions and switch to non-root user
RUN chown -R 1001:0 /bin/server && chmod -R g=u /bin/server
USER 1001

ENTRYPOINT ["/bin/server"]