Dockerfile.internal.amd64

# use the internal builder image for building cloudflared
ARG CLOUDFLARE_DOCKER_REGISTRY_HOST
FROM ${CLOUDFLARE_DOCKER_REGISTRY_HOST:-registry.cfdata.org}/stash/plat/dockerfiles/debian-trixie-golang/master:1.27.3-1@sha256:521137a205e8e2efcbbc933d2f28d9ef05e14be4a75d16e34dbb73939f0f653f AS builder
ARG GOPROXY=https://athens.cfdata.org|https://proxy.golang.org|direct
ENV GO111MODULE=on \
  CGO_ENABLED=0 \
  GOPROXY=${GOPROXY} \
  # the CONTAINER_BUILD envvar is used set github.com/cloudflare/cloudflared/metrics.Runtime=virtual
  # which changes how cloudflared binds the metrics server
  CONTAINER_BUILD=1

WORKDIR /go/src/github.com/cloudflare/cloudflared/

# Download dependencies in their own layer so source-only changes reuse it.
COPY go.mod go.sum ./
RUN go mod download

COPY . .

# compile cloudflared
RUN FIPS=true GOOS=linux GOARCH=amd64 make cloudflared

# use a distroless base image with glibc
FROM gcr.io/distroless/base-debian13:nonroot-amd64@sha256:91475ae1743239ff0810c39688162aaf4bb0b7a12f126b893e8cbc07ace242ee

LABEL org.opencontainers.image.source="https://github.com/cloudflare/cloudflared"

# copy our compiled binary
COPY --from=builder --chown=nonroot /go/src/github.com/cloudflare/cloudflared/cloudflared /usr/local/bin/

# run as nonroot user
# We need to use numeric user id's because Kubernetes doesn't support strings:
# https://github.com/kubernetes/kubernetes/blob/v1.33.2/pkg/kubelet/kuberuntime/security_context_others.go#L49
# The `nonroot` user maps to `65532`, from: https://github.com/GoogleContainerTools/distroless/blob/main/common/variables.bzl#L18
USER 65532:65532

# disable autoupdate: images are updated by pulling a new tag, not by replacing the binary in place.
# set as an env var rather than an entrypoint flag, so it still applies when the entrypoint is overridden.
ENV NO_AUTOUPDATE=true

# command / entrypoint of container
ENTRYPOINT ["cloudflared"]
CMD ["version"]