FROM golang:1.26-trixie AS builder

RUN apt-get update && apt-get upgrade -y &&\
  mkdir -p /var/lib/sqlite

WORKDIR /go/src/github.com/ory/kratos

COPY oryx/go.mod oryx/go.mod
COPY oryx/go.sum oryx/go.sum
                

COPY go.mod go.mod
COPY go.sum go.sum
COPY pkg/client-go/go.* pkg/client-go/

ENV CGO_ENABLED 0

RUN go mod download

COPY . .

ARG VERSION
ARG COMMIT
ARG BUILD_DATE

RUN --mount=type=cache,target=/root/.cache/go-build go build \
  -ldflags="-X 'github.com/ory/kratos/driver/config.Version=${VERSION}' -X 'github.com/ory/kratos/driver/config.Date=${BUILD_DATE}' -X 'github.com/ory/kratos/driver/config.Commit=${COMMIT}'" \
  -o /usr/bin/kratos

#########################
# Kratos is built with CGO_ENABLED=0, so it needs no glibc at runtime. The static
# base carries none, which keeps this image free of the unfixable libc6
# advisories the base-nossl variant ships with, and matches the base the released
# images use (.docker/Dockerfile-distroless-static).
FROM gcr.io/distroless/static-debian12:nonroot AS runner

COPY --from=builder --chown=nonroot:nonroot /var/lib/sqlite /var/lib/sqlite
COPY --from=builder --chown=nonroot:nonroot /usr/bin/kratos /usr/bin/kratos

VOLUME /var/lib/sqlite

# Declare the standard ports used by Kratos (4433 for public service endpoint, 4434 for admin service endpoint)
EXPOSE 4433 4434

ENTRYPOINT ["kratos"]
CMD ["serve"]