clearcutt-go1.26 : dev

# Stage 1: Compile statically-linked Go binary in the Go dev builder
FROM ghcr.io/northcutted/clearcutt/clearcutt-go1.26:v0.8.0-dev AS builder
WORKDIR /app

COPY go.mod go.sum ./
RUN go mod download

COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s" -o main .

# Stage 2: Hardened runner stage (distroless or slim OCI runtime)
FROM ghcr.io/northcutted/clearcutt/clearcutt-go1.26:v0.8.0-dev
WORKDIR /app

# Copy statically-linked compiled Go executable
COPY --from=builder /app/main ./main

# Run Go application as secure non-root operator
USER 10001:10001
CMD ["./main"]

# Run an interactive local dev shell with the exact same remediated Go toolchain:
$ nix shell github:northcutted/clearcutt-images/v0.8.0#clearcuttGo126-native

# Or declare inside your local flake.nix environment:
{
  inputs.clearcutt.url = "github:northcutted/clearcutt-images/v0.8.0";
  outputs = { self, nixpkgs, clearcutt }: {
    devShells.x86_64-linux.default = let
      pkgs = import nixpkgs {
        system = "x86_64-linux";
        overlays = [ clearcutt.overlays.default ];
      };
    in pkgs.mkShell {
      buildInputs = [ pkgs.clearcuttGo126 ];
    };
  };
}

# Build a Go custom image declaratively by compiling via Nix and packaging
pkgs.dockerTools.buildImage {
  name = "custom-go-server";
  tag = "latest";
  
  # Layer on top of ClearCutt's base
  fromImage = clearcutt-base-image;

  copyToRoot = pkgs.buildEnv {
    name = "image-root";
    paths = [
      go-application-compiled  # Pure Go binary compiled declaratively via Nix
    ];
    pathsToLink = [ "/bin" ];
  };

  config = {
    Cmd = [ "/bin/server" ];
    User = "10001:10001";
  };
}