FROM golang:1.26-alpine AS builder
USER root
WORKDIR /src
COPY go.mod go.sum /src/
RUN go mod download
COPY . /src/
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/est ./cmd/est

FROM alpine:3.24
RUN apk add --no-cache openssh-client && addgroup -S est && adduser -S -D -H -G est est
WORKDIR /app
COPY --from=builder --chown=est:est /out/est /app/est
USER est:est
ENTRYPOINT ["/app/est"]