# Minimal glibc runtime (Debian bookworm, same OS line as golang:1.24 images). The full golang image
# drags in the compiler/toolchain and many packages → scanners often report many HIGH CVEs you do not
# need at runtime. CGO binaries still must not use Alpine/musl (e.g. fcntl64: symbol not found).
#
# Pin to Debian's dated snapshot tag (not the floating bookworm-slim) for reproducible builds; bump
# the date when you intentionally refresh the base for security updates (see Docker Hub debian tags).
FROM debian:bookworm-20260316-slim
WORKDIR /
ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update \
	&& apt-get install -y --no-install-recommends ca-certificates tzdata binutils \
	&& rm -rf /var/lib/apt/lists/*
COPY bin/ngm_api ngm_api
ENTRYPOINT ["/ngm_api", "-c=/etc/config/config.yaml"]