FROM gcr.io/distroless/static-debian12:nonroot@sha256:aef9602f8710ec12bde19d593fed1f76c708531bb7aba205110f1029786ead7b

ARG SOURCE_SHA
LABEL org.opencontainers.image.source="https://github.com/pingcap-inc/nexuscrm-controlplane" \
      org.opencontainers.image.revision="${SOURCE_SHA}"
COPY --chown=nonroot:nonroot catalog-reconcile-binary /usr/local/bin/catalog-reconcile
COPY --chown=nonroot:nonroot host-compatibility.json /etc/nexuscrm/host-compatibility.json

USER nonroot:nonroot
ENTRYPOINT ["/usr/local/bin/catalog-reconcile"]