Dockerfile

# syntax=docker/dockerfile:1

# Build the manager binary
FROM golang:1.25 AS builder
ARG TARGETOS
ARG TARGETARCH

WORKDIR /workspace

# Download dependencies with cache mount for better performance
# Cache location: /go/pkg/mod/
RUN --mount=type=bind,source=go.sum,target=go.sum \
    --mount=type=bind,source=go.mod,target=go.mod \
    --mount=type=cache,target=/go/pkg/mod/,sharing=locked \
    go mod download -x

# Build the binary using bind mount instead of COPY
# This avoids copying source files into the image layer
RUN --mount=type=bind,target=. \
    --mount=type=cache,target=/go/pkg/mod/,sharing=locked \
    CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} \
    go build -a -o /manager cmd/main.go

# Use distroless as minimal base image to package the manager binary
# Refer to https://github.com/GoogleContainerTools/distroless for more details
FROM gcr.io/distroless/static:nonroot
WORKDIR /
COPY --from=builder /manager .
USER 65532:65532

ENTRYPOINT ["/manager"]