Dockerfile

# syntax=docker/dockerfile:1.7
# =============================================================================
# go — LLM honeypot persona
# =============================================================================
# Multi-stage build:
#   - build stage compiles all three binaries (runtime, sshfrontend, client)
#   - runtime stage picks the one named by ARG BINARY at compose build time
# -----------------------------------------------------------------------------
FROM golang:1.25-alpine AS build

ARG ARCP_SDK_VERSION=latest
ARG BINARY=runtime

ENV CGO_ENABLED=0 \
    GOFLAGS=-mod=mod

WORKDIR /src

RUN apk add --no-cache git ca-certificates

COPY go.mod go.sum* ./

# Replace the local-path replace directive with a `go get` of the published
# SDK at the requested version. Falls back gracefully if go.sum is absent.
RUN sed -i '/^replace github.com\/agentruntimecontrolprotocol\/go-sdk/d' go.mod && \
    go get "github.com/agentruntimecontrolprotocol/go-sdk@${ARCP_SDK_VERSION}" && \
    go mod tidy

COPY src/ ./src/

RUN go build -trimpath -ldflags="-s -w" -o /out/runtime      ./src/runtime && \
    go build -trimpath -ldflags="-s -w" -o /out/sshfrontend ./src/sshfrontend && \
    go build -trimpath -ldflags="-s -w" -o /out/client      ./src/client

# -----------------------------------------------------------------------------
FROM alpine:3.20 AS runtime

ARG BINARY=runtime
ENV BINARY=${BINARY}

RUN apk add --no-cache tini ca-certificates wget

COPY --from=build /out/runtime      /usr/local/bin/runtime
COPY --from=build /out/sshfrontend /usr/local/bin/sshfrontend
COPY --from=build /out/client      /usr/local/bin/client

ENTRYPOINT ["/sbin/tini", "--"]
CMD ["/bin/sh", "-c", "exec /usr/local/bin/${BINARY}"]