Dockerfile

# syntax=docker/dockerfile:1

# ---- build stage ----
# cgo is required: the tokenizer bindings link a static library and ONNX Runtime
# is loaded at runtime. A glibc base is required (the prebuilt libtokenizers.a is
# a GNU build), so this uses debian-based images rather than Alpine.
FROM golang:1.26-bookworm@sha256:483d6e0728a0e58f9e87e01ae9d80ef4181725efc9fadf659d398b3698bd60f7 AS builder
WORKDIR /src

# Cache module downloads.
COPY go.mod go.sum ./
RUN go mod download

# Fetch native libs (tokenizers static + ONNX Runtime shared) and build both
# binaries.
COPY . .
RUN make libtokenizers libonnxruntime build

# ---- runtime stage ----
FROM debian:bookworm-slim@sha256:0104b334637a5f19aa9c983a91b54c89887c0984081f2068983107a6f6c21eeb AS runtime
RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates libstdc++6 \
    && rm -rf /var/lib/apt/lists/*

COPY --from=builder /src/bin/piguard            /usr/local/bin/piguard
COPY --from=builder /src/bin/piguard-server     /usr/local/bin/piguard-server
COPY --from=builder /src/lib/libonnxruntime.so  /usr/local/lib/libonnxruntime.so

# The tokenizer code is linked statically; only ONNX Runtime is loaded at
# runtime, located via ORT_DYLIB_PATH.
ENV ORT_DYLIB_PATH=/usr/local/lib/libonnxruntime.so

# Run as a non-root user. /run/piguard holds the Unix socket (share it with
# clients via a volume); /models holds the exported model (mount it read-only).
RUN useradd --system --uid 10001 piguard \
    && mkdir -p /run/piguard /models \
    && chown -R piguard /run/piguard
USER piguard

ENTRYPOINT ["piguard-server"]
CMD ["--socket", "/run/piguard/piguard.sock", "--model-dir", "/models"]