Dockerfile.goreleaser

# Base images are pinned by digest so a rebuild of the same release tag starts
# from the same bytes instead of whatever "latest" points at that day.
# Dependabot's docker ecosystem keeps the pins current; do not replace them
# with a floating tag.
#
# This is not full reproducibility: the dnf install below still resolves
# whatever the Red Hat repositories serve at build time.
FROM registry.access.redhat.com/ubi9/ubi:latest@sha256:206b65b8ee0f04b992818c9a51b29081b14974630d4850bc358097d0c44ea156 AS certs
RUN dnf -y install ca-certificates && \
    update-ca-trust && \
    cp /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /tmp/ca-certificates.crt && \
    dnf clean all && \
    rm -rf /var/cache/dnf

FROM registry.access.redhat.com/ubi9/ubi-micro:latest@sha256:f332c99eb8f798a8486821c91937f10ad64ee83d7e739303be2df051040918f6

LABEL maintainer="Ruohang Feng (@Vonng) <rh@vonng.com>" \
      vendor="PGSTY" \
      url="https://silo.pgsty.com" \
      org.opencontainers.image.vendor="PGSTY" \
      org.opencontainers.image.url="https://silo.pgsty.com" \
      org.opencontainers.image.source="https://github.com/pgsty/mc" \
      org.opencontainers.image.description="Silo object storage client (mcli), a community-maintained fork of the MinIO Client." \
      org.opencontainers.image.licenses="AGPL-3.0-or-later" \
      description="Silo object storage client (mcli), a community-maintained fork of the MinIO Client."

COPY --from=certs /tmp/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY mc /usr/bin/mc
COPY LICENSE /licenses/LICENSE
COPY CREDITS /licenses/CREDITS
COPY NOTICE /licenses/NOTICE

RUN chmod +x /usr/bin/mc

ENTRYPOINT ["/usr/bin/mc"]