platform

Dockerfile

@@ -0,0 +1,73 @@
+# Multi-binary image for the platform/ catalog wire harnesses.
+#
+# Build context is the platform/ directory. Modules used by the binaries all
+# live under platform/, so a single-tree build is sufficient — no external
+# replace directives needed.
+#
+# Pure Go: cmd/catalog-emit and cmd/event-emit-publisher use only stdlib +
+# github.com/rabbitmq/amqp091-go + git.k6n.net/mats/platform/* internals.
+# No CGO, so we ship a Debian-bookworm-slim runtime with ca-certificates
+# and a timezone DB. The writer (slask-finder) is NOT built here — it lives
+# in its own Dockerfile and has its own ONNX / libtokenizers deps (CGO).
+
+# ─── 1. Build stage ────────────────────────────────────────────────────────
+FROM golang:1.26-bookworm AS build-stage
+WORKDIR /app
+ENV CGO_ENABLED=0 GOFLAGS="-trimpath"
+
+# Module files first so the dep download caches correctly on rebuild.
+COPY go.mod go.sum ./
+RUN go mod download
+
+# Rest of the source.
+COPY . .
+
+ARG TARGETARCH
+ARG BUILDTIME
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
+    go build -ldflags="-s -w" -o /out/catalog-emit ./cmd/catalog-emit && \
+    CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
+    go build -ldflags="-s -w" -o /out/event-emit-publisher ./cmd/event-emit-publisher
+
+# ─── 2. Runtime stage ────────────────────────────────────────────────────
+FROM debian:bookworm-slim
+
+# ca-certificates for TLS-validated RabbitMQ URLs (amqps://).
+# tzdata so time.Now() resolves zones predictably in logs.
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        ca-certificates \
+        tzdata && \
+    rm -rf /var/lib/apt/lists/*
+
+# Non-root user, matching the k8s securityContext pattern that
+# 20-data-plane.yaml uses for cart/checkout/profile (runAsUser: 1000).
+# Pick 1010 here to leave 1000 available for future platform pods.
+RUN groupadd --gid 1010 platcat && \
+    useradd  --uid 1010 --gid platcat \
+             --home-dir /home/platcat --create-home \
+             --shell /bin/bash platcat
+
+# Binaries straight from the build stage.
+COPY --from=build-stage /out/catalog-emit          /usr/local/bin/catalog-emit
+COPY --from=build-stage /out/event-emit-publisher  /usr/local/bin/event-emit-publisher
+
+# Make them owned by platcat so a non-root pod UID can run them.
+RUN chown platcat:platcat /usr/local/bin/catalog-emit \
+                       /usr/local/bin/event-emit-publisher
+
+USER platcat:platcat
+WORKDIR /home/platcat
+
+# Healthcheck surfaces what's running; useful for `kubectl describe pod`
+# when watching the projection consumer come up.
+HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
+    CMD /usr/local/bin/catalog-emit -h >/dev/null 2>&1 || exit 1
+
+# Production entrypoint is catalog-emit (the consumer harness); the
+# publisher binary is intentionally a sibling so it's invokeable for
+# smoke tests via `kubectl exec <pod> -- /usr/local/bin/event-emit-publisher ...`.
+# The k8s Deployment (52-catalog-emit.yaml) overrides args with the
+# watch-mode flags + -out-dir pointing at the projection PVC.
+ENTRYPOINT ["/usr/local/bin/catalog-emit"]
+CMD ["-h"]