FROM golang:1.22-alpine AS build
WORKDIR /src
COPY go.mod ./
COPY main.go ./
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/vote-service . \
 && mkdir -p /out/data

FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=build /out/vote-service /vote-service
# distroless has no shell/chown; carry a pre-owned dir from the build stage
# so the nonroot user (65532) can write votes.json even without a mounted
# PVC (e.g. local `docker run` smoke tests).
COPY --from=build --chown=nonroot:nonroot /out/data /data
VOLUME ["/data"]
EXPOSE 8080
ENTRYPOINT ["/vote-service"]