Dockerfile.gateway

FROM registry.redhat.io/ubi9/ubi:latest@sha256:cecb1cde7bda7c8165ae27841c2335667f8a3665a349c0d051329c61660a496c as builder

WORKDIR /opt/app-root/src
USER root

RUN dnf install --nodocs -y golang && \
    dnf clean all && \
    rm -rf /var/cache/yum

COPY .git .git
COPY api api
# this directory is checked by ecosystem-cert-preflight-checks task in Konflux
COPY api/LICENSE /licenses/
WORKDIR /opt/app-root/src/api

RUN CGO_ENABLED=1 GOEXPERIMENT=strictfipsruntime go build -mod=mod -tags strictfipsruntime -o tempostack-gateway -trimpath -ldflags "-s -w"

FROM registry.redhat.io/ubi9/ubi-micro:latest@sha256:093a704be0eaef9bb52d9bc0219c67ee9db13c2e797da400ddb5d5ae6849fa10 AS target-base

FROM registry.redhat.io/ubi9/ubi:latest@sha256:cecb1cde7bda7c8165ae27841c2335667f8a3665a349c0d051329c61660a496c as install-additional-packages
COPY --from=target-base / /mnt/rootfs
RUN rpm --root /mnt/rootfs --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

RUN dnf install --installroot /mnt/rootfs --releasever 9 --setopt install_weak_deps=false --setopt reposdir=/etc/yum.repos.d --nodocs -y openssl systemd && \
    dnf clean all && \
    rm -rf /var/cache/yum
RUN rm -rf /mnt/rootfs/var/cache/*

FROM scratch
WORKDIR /
COPY --from=install-additional-packages /mnt/rootfs/ /

ARG VERSION=0.20.0-1

RUN mkdir /licenses
COPY api/LICENSE /licenses/.
COPY --from=builder /opt/app-root/src/api/tempostack-gateway /usr/bin/tempostack-gateway

ARG USER_UID=1001
USER ${USER_UID}
ENTRYPOINT ["/usr/bin/tempostack-gateway"]

LABEL release="${VERSION}" \
      version="${VERSION}" \
      vendor="Red Hat, Inc." \
      distribution-scope="public" \
      url="https://github.com/grafana/tempo-operator" \
      com.redhat.component="tempo-gateway-container" \
      name="rhosdt/tempo-gateway-rhel9" \
      summary="Tempo Gateway" \
      description="Horizontally-scalable authn/authz-securing reverse proxy for Tempo" \
      io.k8s.description="Horizontally-scalable authn/authz-securing reverse proxy for Tempo." \
      io.openshift.tags="tracing" \
      io.k8s.display-name="Tempo Gateway" \
      cpe="cpe:/a:redhat:openshift_distributed_tracing:3.9::el9"