build: add multi-stage image

.dockerignore

@@ -0,0 +1,11 @@
+.git
+.github
+.env
+.env.*
+!.env.example
+docs
+tests
+uploads
+micrach
+*.out
+*.test

Dockerfile

@@ -1,8 +1,24 @@
-FROM busybox
+FROM golang:1.26.5-alpine3.24 AS build
+
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/micrach .
+
+FROM alpine:3.24.1
+
+RUN apk add --no-cache ca-certificates \
+    && addgroup -S micrach \
+    && adduser -S -G micrach micrach \
+    && mkdir -p /app/uploads \
+    && chown -R micrach:micrach /app
+
 WORKDIR /app
-COPY templates/ templates/
-COPY static/ static/
-COPY migrations/ migrations/
-COPY micrach ./
-RUN chmod +x /app/micrach
-ENTRYPOINT ["/app/micrach"]
+COPY --from=build /out/micrach ./micrach
+COPY --chown=micrach:micrach templates/ templates/
+COPY --chown=micrach:micrach static/ static/
+COPY --chown=micrach:micrach migrations/ migrations/
+
+USER micrach
+ENTRYPOINT ["./micrach"]