# Build stage
FROM golang:1.25-alpine AS builder

WORKDIR /app
COPY go.mod go.sum* ./
RUN go mod download 2>/dev/null || true

COPY *.go ./
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s" -o speedtest-server .

# Runtime stage - distroless for minimal attack surface
FROM gcr.io/distroless/static-debian12:latest-amd64

WORKDIR /
COPY --from=builder /app/speedtest-server /speedtest-server

EXPOSE 8080

USER nonroot:nonroot

ENTRYPOINT ["/speedtest-server"]