Dockerfile

# k3helper as a container, for `serve`.
#
# FROM scratch, because the binary needs nothing: the web assets are embedded
# in it, and the cluster is reached over SSH or by a kubectl that lives on the
# nodes. The image is the binary plus certificates, which is what makes it
# around 12MB rather than the few hundred a base image would add.
#
#   docker build -t k3helper .
#   docker run --rm -p 8787:8787 \
#     -v "$PWD/targets.yaml:/targets.yaml:ro" \
#     -v "$HOME/.ssh/id_ed25519:/key:ro" \
#     k3helper serve -t /targets.yaml --host 0.0.0.0 --allow-remote
#
# Mount credentials at run time; never build them in. An image with a private
# key in a layer keeps that key even after a later layer deletes it, and
# anywhere the image goes, the key goes.

FROM golang:1.26-alpine AS build
WORKDIR /src

# Dependencies first, so a change to the source does not refetch them.
COPY go.mod go.sum ./
RUN go mod download

COPY . .
ARG VERSION=dev
# CGO off: the result has to run on scratch, which has no libc to link against.
RUN CGO_ENABLED=0 go build \
      -ldflags "-s -w -X github.com/solutionforest/k3helper/internal/cli.version=${VERSION}" \
      -o /k3helper ./cmd/k3helper

FROM scratch
# Certificates, for the API server's TLS and for `bundle k3s` reaching GitHub.
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=build /k3helper /k3helper

# Nobody. There is nothing in this image to be root for, and a mounted key
# should be readable by this user rather than by everyone.
USER 65534:65534
EXPOSE 8787
ENTRYPOINT ["/k3helper"]
CMD ["serve", "--host", "0.0.0.0", "--allow-remote", "--no-browser"]