Dockerfile

# syntax=docker/dockerfile:1.7

# slim runtime image. the binary is built ahead of time on the CI runner
# (see .github/workflows/release.yml :: build-binaries) and dropped into
# the build context, laid out as `linux/<arch>/<bin>` so this dockerfile
# can pick the right native binary per platform via $TARGETARCH. no rust
# toolchain, no cargo-chef, no compile here.
#
# BIN selects which workspace binary this image ships. defaults to the
# `mars` service binary; override with `--build-arg BIN=mars-operator`
# to produce the operator image.

ARG BIN=mars
ARG CUE_VERSION=v0.16.1

# pull libsqlite3 / libz from a debian:bookworm-slim stage. the FROM
# implicitly resolves to $TARGETPLATFORM so buildx pulls per-arch base
# layers automatically; libs land in the right /usr/lib/<triple>/ for
# the final distroless stage to glob.
FROM debian:bookworm-slim AS libs
RUN apt-get update \
 && apt-get install -y --no-install-recommends libsqlite3-0 \
 && rm -rf /var/lib/apt/lists/*

# fetch the official cue cli release tarball. pinned to $BUILDPLATFORM so
# curl + sha256 run natively on the runner instead of under qemu; we still
# pick the *target* arch tarball via $TARGETARCH so the binary copied into
# the final stage matches the image platform.
FROM --platform=$BUILDPLATFORM debian:bookworm-slim AS cue
ARG CUE_VERSION
ARG TARGETARCH
ARG CUE_SHA256_amd64=5d644c1305a2b86504c8dcd2ec829cf5b4999efc2cf51ee375624e0455f774ae
ARG CUE_SHA256_arm64=3cc715a9e969f87b93c4fa34cfaef5388b93e96efa20b248e8ad6826abd25a83
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates curl \
 && rm -rf /var/lib/apt/lists/* \
 && case "${TARGETARCH}" in \
      amd64) sha="${CUE_SHA256_amd64}" ;; \
      arm64) sha="${CUE_SHA256_arm64}" ;; \
      *) echo "unsupported TARGETARCH=${TARGETARCH}" >&2; exit 1 ;; \
    esac \
 && curl -fsSL -o /tmp/cue.tgz \
      "https://github.com/cue-lang/cue/releases/download/${CUE_VERSION}/cue_${CUE_VERSION}_linux_${TARGETARCH}.tar.gz" \
 && echo "${sha}  /tmp/cue.tgz" | sha256sum -c - \
 && tar -xzf /tmp/cue.tgz -C /tmp cue \
 && install -m 0755 /tmp/cue /usr/local/bin/cue \
 && rm /tmp/cue.tgz /tmp/cue

FROM gcr.io/distroless/cc-debian12:nonroot
ARG TARGETARCH

COPY --from=libs /usr/lib/*-linux-gnu/libsqlite3.so.0 /usr/lib/
COPY --from=libs /lib/*-linux-gnu/libz.so.1           /lib/
COPY --from=cue  /usr/local/bin/cue                   /usr/local/bin/cue

ARG BIN
COPY linux/${TARGETARCH}/${BIN} /usr/local/bin/app

USER nonroot:nonroot
ENTRYPOINT ["/usr/local/bin/app"]

# no image-level HEALTHCHECK: only runtime binds 8080, and orchestrators
# (compose, k8s) configure their own probes against /readyz or /healthz.
# the `mars healthcheck` subcommand stays available for those consumers.