dockerls 1.0.0__py3-none-any.whl

dockerls/infrastructure/templates/hardening/php-ubuntu.dockerfile

@@ -0,0 +1,49 @@
+# Dockerfile.hardened.php-ubuntu
+# Hardened template for PHP 8.3 (Ubuntu 24.04 LTS)
+
+ARG UBUNTU_VERSION=24.04
+ARG COMPOSER_VERSION=2
+
+# Stage 1: Composer dependencies
+FROM composer:${COMPOSER_VERSION} AS vendor
+
+WORKDIR /app
+COPY composer.json composer.lock ./
+RUN composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader || true
+
+# Stage 2: PHP Runtime
+FROM ubuntu:${UBUNTU_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    php-cli php-fpm php-mbstring php-xml php-curl ca-certificates \
+    && groupadd -g 10001 appgroup \
+    && useradd -u 10001 -g appgroup -s /usr/sbin/nologin -m appuser \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+WORKDIR /app
+
+COPY --from=vendor --chown=appuser:appgroup /app/vendor ./vendor
+COPY --chown=appuser:appgroup . .
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
+    CMD php -v || exit 1
+
+EXPOSE 8000
+
+ENTRYPOINT ["php"]
+CMD ["-S", "0.0.0.0:8000", "-t", "public"]

dockerls/infrastructure/templates/hardening/php.dockerfile

@@ -0,0 +1,44 @@
+# Dockerfile.hardened.php
+# Hardened template for PHP 8.3 - Production Ready
+
+# Stage 1: Composer Builder
+FROM composer:2 AS composer_stage
+
+WORKDIR /app
+COPY composer.json composer.lock* ./
+RUN composer install --no-dev --prefer-dist --no-interaction --optimize-autoloader --no-scripts || true
+
+# Stage 2: Runtime PHP 8.3 Alpine
+FROM php:8.3-cli-alpine
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="your-team@company.com"
+LABEL security.cve-contact="security@company.com"
+
+# Opcache and secure extensions
+RUN docker-php-ext-enable opcache || true
+
+RUN addgroup -g 10001 appgroup && \
+    adduser -D -u 10001 -G appgroup -h /home/appuser appuser
+
+WORKDIR /app
+
+COPY --from=composer_stage --chown=appuser:appgroup /app/vendor /app/vendor
+COPY --chown=appuser:appgroup . .
+
+# Build metadata
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD php -v || exit 1
+
+EXPOSE 8000
+
+ENTRYPOINT ["php"]
+CMD ["-S", "0.0.0.0:8000", "-t", "public"]

dockerls/infrastructure/templates/hardening/python-alpine.dockerfile

@@ -0,0 +1,51 @@
+# Dockerfile.hardened.python-alpine
+# Hardened template for Python 3.12 (Alpine Linux musl)
+
+ARG PYTHON_VERSION=3.12-alpine
+
+# Stage 1: Builder
+FROM python:${PYTHON_VERSION} AS builder
+
+WORKDIR /app
+
+RUN apk add --no-cache gcc musl-dev libffi-dev openssl-dev
+
+COPY requirements*.txt ./
+RUN pip install --no-cache-dir --user -r requirements.txt
+
+# Stage 2: Runtime
+FROM python:${PYTHON_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PATH=/home/appuser/.local/bin:$PATH
+
+RUN addgroup -g 10001 appgroup \
+    && adduser -u 10001 -G appgroup -s /sbin/nologin -D appuser \
+    && apk update && apk upgrade --no-cache \
+    && rm -rf /var/cache/apk/*
+
+WORKDIR /app
+
+COPY --from=builder --chown=appuser:appgroup /root/.local /home/appuser/.local
+COPY --chown=appuser:appgroup . .
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=3)" || exit 1
+
+EXPOSE 8000
+
+ENTRYPOINT ["python"]
+CMD ["-u", "main.py"]

dockerls/infrastructure/templates/hardening/python-debian.dockerfile

@@ -0,0 +1,54 @@
+# Dockerfile.hardened.python-debian
+# Hardened template for Python 3.12 (Debian Bookworm Slim - glibc)
+
+ARG PYTHON_VERSION=3.12-slim-bookworm
+
+# Stage 1: Builder
+FROM python:${PYTHON_VERSION} AS builder
+
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY requirements*.txt ./
+RUN pip install --no-cache-dir --user -r requirements.txt
+
+# Stage 2: Runtime
+FROM python:${PYTHON_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PATH=/home/appuser/.local/bin:$PATH
+
+RUN apt-get update && apt-get upgrade -y \
+    && apt-get install -y --no-install-recommends ca-certificates \
+    && groupadd -g 10001 appgroup \
+    && useradd -u 10001 -g appgroup -s /usr/sbin/nologin -m appuser \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+WORKDIR /app
+
+COPY --from=builder --chown=appuser:appgroup /root/.local /home/appuser/.local
+COPY --chown=appuser:appgroup . .
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=3)" || exit 1
+
+EXPOSE 8000
+
+ENTRYPOINT ["python"]
+CMD ["-u", "main.py"]

dockerls/infrastructure/templates/hardening/python-distroless.dockerfile

@@ -0,0 +1,51 @@
+# Dockerfile.hardened.python-distroless
+# Hardened template for Python 3.12 (Google Distroless - No Shell)
+
+ARG DEBIAN_VERSION=bookworm-slim
+
+# Stage 1: Builder
+FROM debian:${DEBIAN_VERSION} AS builder
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    python3 python3-pip python3-venv ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+RUN python3 -m venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
+COPY requirements*.txt ./
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY . .
+
+# Stage 2: Distroless Runtime (No Shell)
+FROM gcr.io/distroless/python3-debian12:nonroot
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PATH="/opt/venv/bin:$PATH"
+
+WORKDIR /app
+
+COPY --from=builder /opt/venv /opt/venv
+COPY --from=builder /app /app
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+# nonroot user in Distroless is 65532:65532
+USER 65532:65532
+
+EXPOSE 8000
+
+ENTRYPOINT ["/usr/bin/python3"]
+CMD ["-u", "main.py"]

dockerls/infrastructure/templates/hardening/python-ubuntu.dockerfile

@@ -0,0 +1,60 @@
+# Dockerfile.hardened.python-ubuntu
+# Hardened template for Python 3.12 (Ubuntu 24.04 LTS)
+
+ARG UBUNTU_VERSION=24.04
+
+# Stage 1: Builder
+FROM ubuntu:${UBUNTU_VERSION} AS builder
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    python3 python3-pip python3-venv build-essential ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+RUN python3 -m venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
+COPY requirements*.txt ./
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Stage 2: Runtime
+FROM ubuntu:${UBUNTU_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PATH="/opt/venv/bin:$PATH"
+
+RUN apt-get update && apt-get upgrade -y \
+    && apt-get install -y --no-install-recommends python3 ca-certificates \
+    && groupadd -g 10001 appgroup \
+    && useradd -u 10001 -g appgroup -s /usr/sbin/nologin -m appuser \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+WORKDIR /app
+
+COPY --from=builder /opt/venv /opt/venv
+COPY --chown=appuser:appgroup . .
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD python3 -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=3)" || exit 1
+
+EXPOSE 8000
+
+ENTRYPOINT ["python3"]
+CMD ["-u", "main.py"]

dockerls/infrastructure/templates/hardening/python.dockerfile

@@ -0,0 +1,58 @@
+# Dockerfile.hardened.python
+# Hardened template for Python - Production Ready
+
+ARG PYTHON_VERSION=3.12-alpine
+
+# Stage 1: Builder
+FROM python:${PYTHON_VERSION} AS builder
+
+WORKDIR /app
+
+# Install temporary build dependencies
+RUN apk add --no-cache \
+    gcc \
+    musl-dev \
+    libffi-dev \
+    && rm -rf /var/cache/apk/*
+
+COPY requirements.txt .
+RUN pip install --user --no-cache-dir -r requirements.txt
+
+# Stage 2: Runtime
+FROM python:${PYTHON_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="your-team@company.com"
+LABEL security.cve-contact="security@company.com"
+
+# Secure environment variables for Python
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PATH=/home/appuser/.local/bin:$PATH
+
+RUN addgroup -g 10001 appgroup && \
+    adduser -D -u 10001 -G appgroup -h /home/appuser appuser
+
+WORKDIR /app
+
+COPY --from=builder --chown=appuser:appgroup /root/.local /home/appuser/.local
+COPY --chown=appuser:appgroup . .
+
+# Build metadata
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+# Health check using the standard library (urllib) -- no external dependencies
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=3)" || exit 1
+
+EXPOSE 8000
+
+# No shell - exec form
+ENTRYPOINT ["python"]
+CMD ["-u", "main.py"]

dockerls/infrastructure/templates/hardening/ruby-alpine.dockerfile

@@ -0,0 +1,48 @@
+# Dockerfile.hardened.ruby-alpine
+# Hardened template for Ruby 3.3 (Alpine Linux)
+
+ARG RUBY_VERSION=3.3-alpine
+
+# Stage 1: Builder
+FROM ruby:${RUBY_VERSION} AS builder
+
+WORKDIR /app
+
+RUN apk add --no-cache build-base
+
+COPY Gemfile Gemfile.lock* ./
+RUN bundle config set --local without 'development test' \
+    && bundle install --jobs=4 --retry=3
+
+# Stage 2: Runtime
+FROM ruby:${RUBY_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+RUN apk update && apk upgrade --no-cache \
+    && addgroup -g 10001 appgroup \
+    && adduser -u 10001 -G appgroup -s /sbin/nologin -D appuser \
+    && rm -rf /var/cache/apk/*
+
+WORKDIR /app
+
+COPY --from=builder --chown=appuser:appgroup /usr/local/bundle /usr/local/bundle
+COPY --chown=appuser:appgroup . .
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD ruby -v || exit 1
+
+EXPOSE 3000
+
+ENTRYPOINT ["bundle", "exec"]
+CMD ["ruby", "app.rb"]

dockerls/infrastructure/templates/hardening/ruby-debian.dockerfile

@@ -0,0 +1,50 @@
+# Dockerfile.hardened.ruby-debian
+# Hardened template for Ruby 3.3 (Debian Bookworm Slim)
+
+ARG RUBY_VERSION=3.3-slim-bookworm
+
+# Stage 1: Builder
+FROM ruby:${RUBY_VERSION} AS builder
+
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY Gemfile Gemfile.lock* ./
+RUN bundle config set --local without 'development test' \
+    && bundle install --jobs=4 --retry=3
+
+# Stage 2: Runtime
+FROM ruby:${RUBY_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+RUN apt-get update && apt-get upgrade -y \
+    && groupadd -g 10001 appgroup \
+    && useradd -u 10001 -g appgroup -s /usr/sbin/nologin -m appuser \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+WORKDIR /app
+
+COPY --from=builder --chown=appuser:appgroup /usr/local/bundle /usr/local/bundle
+COPY --chown=appuser:appgroup . .
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD ruby -v || exit 1
+
+EXPOSE 3000
+
+ENTRYPOINT ["bundle", "exec"]
+CMD ["ruby", "app.rb"]

dockerls/infrastructure/templates/hardening/rust-alpine.dockerfile

@@ -0,0 +1,50 @@
+# Dockerfile.hardened.rust-alpine
+# Hardened template for Rust (Alpine Linux)
+
+ARG RUST_VERSION=1.82-alpine
+ARG ALPINE_VERSION=3.20
+
+# Stage 1: Builder
+FROM rust:${RUST_VERSION} AS builder
+
+RUN apk update && apk add --no-cache musl-dev
+
+WORKDIR /app
+
+COPY Cargo.toml Cargo.lock ./
+COPY src ./src
+
+RUN cargo build --release \
+    && cp /app/target/release/app /app/binary || cp /app/target/release/* /app/binary
+
+# Stage 2: Alpine Runtime
+FROM alpine:${ALPINE_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+RUN apk update && apk upgrade --no-cache \
+    && apk add --no-cache ca-certificates tzdata \
+    && addgroup -g 10001 appgroup \
+    && adduser -u 10001 -G appgroup -s /sbin/nologin -D appuser \
+    && rm -rf /var/cache/apk/*
+
+WORKDIR /app
+
+COPY --from=builder /app/binary /app/binary
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
+    CMD [ -f /app/binary ] || exit 1
+
+EXPOSE 8080
+
+ENTRYPOINT ["/app/binary"]

dockerls/infrastructure/templates/hardening/rust-debian.dockerfile

@@ -0,0 +1,48 @@
+# Dockerfile.hardened.rust-debian
+# Hardened template for Rust (Debian Bookworm Slim)
+
+ARG RUST_VERSION=1.82-bookworm
+ARG DEBIAN_VERSION=bookworm-slim
+
+# Stage 1: Builder
+FROM rust:${RUST_VERSION} AS builder
+
+WORKDIR /app
+
+COPY Cargo.toml Cargo.lock ./
+COPY src ./src
+
+RUN cargo build --release \
+    && cp /app/target/release/app /app/binary || cp /app/target/release/* /app/binary
+
+# Stage 2: Debian Runtime
+FROM debian:${DEBIAN_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+RUN apt-get update && apt-get upgrade -y \
+    && apt-get install -y --no-install-recommends ca-certificates tzdata \
+    && groupadd -g 10001 appgroup \
+    && useradd -u 10001 -g appgroup -s /usr/sbin/nologin -m appuser \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+WORKDIR /app
+
+COPY --from=builder /app/binary /app/binary
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
+    CMD [ -f /app/binary ] || exit 1
+
+EXPOSE 8080
+
+ENTRYPOINT ["/app/binary"]

dockerls/infrastructure/templates/hardening/rust-scratch.dockerfile

@@ -0,0 +1,44 @@
+# Dockerfile.hardened.rust-scratch
+# Hardened template for Rust (Scratch - Zero OS CVEs)
+
+ARG RUST_VERSION=1.82-alpine
+
+# Stage 1: Builder (Alpine musl static compilation)
+FROM rust:${RUST_VERSION} AS builder
+
+RUN apk update && apk add --no-cache musl-dev ca-certificates tzdata \
+    && rustup target add x86_64-unknown-linux-musl
+
+WORKDIR /app
+
+COPY Cargo.toml Cargo.lock ./
+COPY src ./src
+
+# Secure static compilation
+RUN RUSTFLAGS="-C target-feature=+crt-static" \
+    cargo build --release --target x86_64-unknown-linux-musl \
+    && cp /app/target/x86_64-unknown-linux-musl/release/app /app/binary || cp /app/target/x86_64-unknown-linux-musl/release/* /app/binary
+
+# Stage 2: Scratch Runtime
+FROM scratch
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
+COPY --from=builder /app/binary /app/binary
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+# nobody user (UID 65534:65534)
+USER 65534:65534
+
+EXPOSE 8080
+
+ENTRYPOINT ["/app/binary"]

dockerls/infrastructure/templates/hardening/rust.dockerfile

@@ -0,0 +1,54 @@
+# Dockerfile.hardened.rust
+# Hardened template for Rust - Production Ready Static Binary
+
+# Stage 1: Builder
+FROM rust:1.82-alpine AS builder
+
+WORKDIR /app
+
+# musl build dependencies
+RUN apk add --no-cache musl-dev ca-certificates && rm -rf /var/cache/apk/*
+
+COPY Cargo.toml Cargo.lock* ./
+
+# Copy source code
+COPY src ./src
+
+# Static release compilation
+RUN RUSTFLAGS="-C target-feature=+crt-static" cargo build --release --target x86_64-unknown-linux-musl || \
+    cargo build --release
+
+# Locate the generated binary
+RUN if [ -f target/x86_64-unknown-linux-musl/release/app ]; then \
+        cp target/x86_64-unknown-linux-musl/release/app /app/binary; \
+    else \
+        find target/release -maxdepth 1 -type f -executable -exec cp {} /app/binary \; ; \
+    fi
+
+# Stage 2: Runtime minimal (scratch)
+FROM scratch
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="your-team@company.com"
+LABEL security.cve-contact="security@company.com"
+
+# Build metadata
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+# Copy SSL root certificates
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+
+# Copy the application binary
+COPY --from=builder /app/binary /app
+
+EXPOSE 8080
+
+# Non-root user (nobody)
+USER 65534:65534
+
+# Formato exec
+ENTRYPOINT ["/app"]