feat: switch to scratch-based Docker image with static binary

Author: lnliz

Dockerfile

@@ -1,6 +1,6 @@
 FROM golang:1.26-alpine AS builder
 
-RUN apk add --no-cache gcc musl-dev sqlite-dev make
+RUN apk add --no-cache gcc musl-dev sqlite-dev make ca-certificates
 
 WORKDIR /app
 
@@ -9,16 +9,15 @@ COPY go.mod go.sum ./
 COPY . .
 
 ARG COMMIT_HASH
-RUN CGO_ENABLED=1 go build -ldflags="-X github.com/lnliz/faucet.coinbin.org/service.CommitHash=${COMMIT_HASH}" -o app .
+RUN CGO_ENABLED=1 go build -ldflags="-X github.com/lnliz/faucet.coinbin.org/service.CommitHash=${COMMIT_HASH} -linkmode external -extldflags '-static'" -o app .
 
-FROM alpine:3.23
+FROM scratch
 
-RUN apk add --no-cache sqlite-libs
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=builder /app/app       /app/app
+COPY --from=builder /app/templates /app/templates
+COPY --from=builder /app/static   /app/static
 
 WORKDIR /app
 
-COPY --from=builder /app/app       .
-COPY --from=builder /app/templates ./templates
-COPY --from=builder /app/static ./static
-
 ENTRYPOINT ["/app/app"]