FROM gcr.io/distroless/base-debian12:nonroot
ARG TARGETPLATFORM
WORKDIR /go/src/app
COPY --chmod=777 --chown=nonroot:nonroot static/app /go/src/app
COPY ${TARGETPLATFORM}/graphql-proxy /go/src/app/graphql-proxy
# Runtime tuning: operators should override GOMEMLIMIT per deployment
# to match container memory limits (e.g. set to ~80% of cgroup limit).
ENV GOMEMLIMIT=512MiB
# NOTE: no HEALTHCHECK — distroless:nonroot lacks /bin/sh and curl/wget.
# Use orchestrator-level probes (Kubernetes liveness/readiness) hitting /live on monitoring port.
ENTRYPOINT ["/go/src/app/graphql-proxy"]