Update Dockerfile

Update container version and run webhook under unprivileged account

Author: vadimkim

Dockerfile

@@ -1,7 +1,8 @@
-FROM golang:1.23-alpine3.20 AS build_deps
+# ---- Build dependencies ----
+FROM golang:1.25-alpine3.22 AS build_deps
 ARG TARGETARCH
 
-RUN apk add --no-cache git=2.45.3-r0
+RUN apk add --no-cache git
 
 WORKDIR /workspace
 ENV GO111MODULE=on
@@ -11,17 +12,22 @@ COPY go.sum .
 
 RUN go mod download
 
+# ---- Build stage ----
 FROM build_deps AS build
 
 COPY . .
 
 RUN CGO_ENABLED=0 GOARCH=$TARGETARCH go build -o webhook -ldflags '-w -extldflags "-static"' .
 
-FROM alpine:3.20
+# ---- Final runtime image ----
+FROM alpine:3.22
 LABEL maintainer="vadimkim <[email protected]>"
 LABEL org.opencontainers.image.source="https://github.com/vadimkim/cert-manager-webhook-hetzner"
 
-RUN apk add --no-cache ca-certificates=20241121-r1
+# Install minimal runtime
+RUN apk add --no-cache ca-certificates \
+    && adduser -D -u 1000 appuser
+USER appuser
 
 COPY --from=build /workspace/webhook /usr/local/bin/webhook