chore: update dockerfile to use scratch and nonroot user

Dockerfile

@@ -1,31 +1,28 @@
 ############################
 # STEP 1 build executable binary
 ############################
-FROM golang:buster as builder
-EXPOSE 8080
+FROM golang:1.22-bullseye AS build
+
+RUN useradd -u 1001 nonroot
 RUN update-ca-certificates
+
 WORKDIR /go/bin
 COPY . .
-RUN CGO_ENABLED=1 go build -buildvcs=false -o /go/bin/managed-api cmd/main.go
+RUN CGO_ENABLED=1 go build -buildvcs=false -ldflags="-linkmode external -extldflags -static" -o /go/bin/managed-api cmd/main.go
+
 
 ############################
 # STEP 2 create final image
 ############################
+FROM scratch
 
-FROM debian:buster-slim
+WORKDIR /go/bin
 
-RUN apt-get update && \
-    apt-get install -y ca-certificates sudo && \
-    adduser --disabled-password nonroot && \
-    echo 'nonroot ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers \
-RUN update-ca-certificates
+COPY --from=build /etc/passwd /etc/passwd
+COPY --from=build /go/bin/managed-api managed-api
+COPY --from=build /go/bin/static static
 
 USER nonroot
+EXPOSE 8080
 
-WORKDIR /home/nonroot/app
-COPY --from=builder --chown=nonroot:nonroot /go/bin/managed-api /home/nonroot/app/managed-api
-COPY --from=builder --chown=nonroot:nonroot /go/bin/static /home/nonroot/app/static
-
-RUN chmod -R 755 /home/nonroot/app
-
-ENTRYPOINT ["/home/nonroot/app/managed-api"]
+CMD ["/go/bin/managed-api"]

docker-compose.yaml

@@ -3,11 +3,11 @@ services:
     image: bloock/managed-api:latest
     container_name: bloock-managed-api
     volumes:
-      - ./config.yaml:/home/nonroot/app/config.yaml:ro
-      - ./data:/home/nonroot/app/data
+      - ./config.yaml:/go/bin/config.yaml:ro
+      - ./data:/go/bin/data
     ports:
       - 8080:8080
     environment:
       BLOOCK_BLOOCK_API_KEY: ""
       BLOOCK_BLOOCK_WEBHOOK_SECRET_KEY: ""
-      BLOOCK_WEBHOOK_CLIENT_ENDPOINT_URL: ""
+      BLOOCK_WEBHOOK_CLIENT_ENDPOINT_URL: ""