# Panel agent — production image.
# Build from the repo root:  docker build -f deploy/Dockerfile.agent .
#
# ┌─────────────────────────────── SECURITY ───────────────────────────────┐
# │ The agent container mounts the HOST Docker socket (/var/run/docker.sock)│
# │ to create/manage game-server containers. Access to the docker socket   │
# │ is equivalent to root on the host. Only run this on a machine you      │
# │ fully control, and never expose the socket beyond this container.      │
# └─────────────────────────────────────────────────────────────────────────┘

FROM golang:1.26 AS build
ARG VERSION=dev
WORKDIR /src
COPY . .
ENV CGO_ENABLED=0
RUN go build -trimpath \
      -ldflags "-s -w -X github.com/dbledeez/panel/pkg/version.Version=${VERSION}" \
      -o /out/agent ./agent/cmd/agent

# Not distroless: game-module install hooks may shell out (tar, unzip).
FROM debian:12-slim
RUN apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates tar unzip xz-utils \
 && rm -rf /var/lib/apt/lists/*
WORKDIR /opt/panel
COPY --from=build /out/agent   /opt/panel/bin/agent
COPY --from=build /src/modules /opt/panel/modules
# Instance data, sidecar metadata, backups, pairing certs — persist this.
VOLUME ["/opt/panel/data"]
ENTRYPOINT ["/opt/panel/bin/agent"]
CMD ["--controller", "controller:8443", \
     "--modules-dir", "./modules", \
     "--data-root", "./data/instances", \
     "--meta-dir", "./data/instance-meta", \
     "--backup-dir", "./data/backups", \
     "--cert-dir", "./data/certs"]