Dockerfile.export-worker

# Build stage
FROM golang:1.25-alpine AS builder

RUN apk add --no-cache git ca-certificates tzdata

WORKDIR /src

COPY go.mod ./
COPY go.sum* ./
RUN go mod download 2>/dev/null || true

COPY . .
RUN go mod tidy

ARG VERSION=dev

# Memory-conservative compile to avoid Go 1.25 inliner crashes on
# constrained CI runners. The `internal/api` package is large (~219 files)
# and the inliner can panic at sync/atomic/type.go under memory pressure.
#  - GOMEMLIMIT bounds Go's GC growth so peak RSS stays within runner limits
#  - `-p 2` caps parallel compile jobs (default = NumCPU, often too high)
#  - `-gcflags=all=-l` disables inlining (sidesteps the inliner crash with
#    a small binary-size / perf cost that's negligible for an I/O-bound
#    worker)
RUN GOMEMLIMIT=2GiB CGO_ENABLED=0 GOOS=linux go build \
    -p 2 \
    -gcflags=all=-l \
    -ldflags="-s -w -X main.Version=${VERSION}" \
    -o /bin/export-worker ./cmd/export-worker

# Runtime stage — distroless
FROM gcr.io/distroless/static:nonroot

COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /bin/export-worker /usr/local/bin/export-worker

USER nonroot:nonroot

EXPOSE 8082

ENTRYPOINT ["export-worker"]