Dockerfile.fips

ARG GO_VERSION
FROM mcr.microsoft.com/oss/go/microsoft/golang:${GO_VERSION}-1-fips-bookworm AS base

ENV FIPS=true
ENV CGO_ENABLED=1

RUN mkdir -p /.cache \
  && chmod 777 /.cache

WORKDIR /go/src/github.com/elastic/fleet-server

# pre-copy/cache go.mod for pre-downloading dependencies and only redownloading them in subsequent builds if they change
COPY go.mod go.sum ./
RUN go mod download && go mod verify

ENTRYPOINT [ "make" ]
CMD [ "release" ]

FROM base AS builder

COPY . .

ARG GCFLAGS=""
ARG LDFLAGS=""
ARG DEV=""
ARG TARGETPLATFORM

RUN FIPS=true CGO_ENABLED=1 GCFLAGS="${GCFLAGS}" LDFLAGS="${LDFLAGS}" DEV="${DEV}" make release-${TARGETPLATFORM}

FROM docker.elastic.co/wolfi/glibc-openssl-fips:latest
ARG VERSION
ARG TARGETOS
ARG TARGETARCH

RUN groupadd --gid 1000 fleet-server && \
    useradd -M --uid 1000 --gid 1000 fleet-server

USER fleet-server

COPY --chown=fleet-server:fleet-server --chmod=644 fleet-server.yml /etc/fleet-server.yml
COPY --chown=fleet-server:fleet-server --chmod=755 --from=builder /usr/src/fleet-server/build/binaries/fleet-server-${VERSION}-${TARGETOS:-linux}-*/fleet-server /usr/bin/fleet-server

ENV GOFIPS=1

CMD /usr/bin/fleet-server -c /etc/fleet-server.yml