Dockerfile

# syntax=docker/dockerfile:1.7

# Stage 0: fetch the DB-IP free ASN MMDB. dbip releases monthly under
# yyyy-mm-named files; on the first day or two of a month the new file
# may not yet be published, so we walk back up to two months. The DB
# itself is read at runtime to enrich saved results with the AS org
# (displayed as "ISP" in the UI).
FROM alpine:3 AS asndb
RUN apk add --no-cache curl ca-certificates
WORKDIR /asn
RUN set -eu; \
    YEAR=$(date -u +%Y); MONTH=$(date -u +%m); \
    for OFFSET in 0 1 2; do \
        M=$((10#$MONTH - OFFSET)); Y=$YEAR; \
        if [ "$M" -le 0 ]; then M=$((M + 12)); Y=$((Y - 1)); fi; \
        YM=$(printf '%04d-%02d' "$Y" "$M"); \
        URL="https://download.db-ip.com/free/dbip-asn-lite-${YM}.mmdb.gz"; \
        echo "Trying $URL"; \
        if curl -fsSL -o asn.mmdb.gz "$URL"; then break; fi; \
    done; \
    test -f asn.mmdb.gz || (echo "Failed to download ASN DB" >&2; exit 1); \
    gunzip asn.mmdb.gz

# Stage 1: build the frontend
FROM node:20-alpine AS web
WORKDIR /web
RUN corepack enable
COPY web/package.json web/pnpm-lock.yaml* ./
RUN pnpm install --frozen-lockfile || pnpm install
COPY web/ ./
RUN pnpm build

# Stage 2: build the Go binary with the embedded frontend
FROM golang:1.25-alpine AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
# Replace the placeholder embed dir with the freshly built frontend.
RUN rm -rf internal/server/dist && mkdir -p internal/server/dist
COPY --from=web /web/dist/ internal/server/dist/
ARG VERSION=dev
RUN CGO_ENABLED=0 GOOS=linux go build \
    -trimpath \
    -ldflags="-s -w -X github.com/seitzbg/speedtest/internal/server.AppVersion=${VERSION}" \
    -o /out/speedtest ./cmd/speedtest

# Pre-create /data with the nonroot UID so anonymous volumes inherit the
# right ownership. Distroless has no shell so we do this in a stage that has
# one, then COPY --chown.
RUN mkdir -p /out/data

# Stage 3: minimal final image
FROM gcr.io/distroless/static-debian12:nonroot
WORKDIR /
COPY --from=build /out/speedtest /speedtest
COPY --from=build --chown=65532:65532 /out/data /data
COPY --from=asndb /asn/asn.mmdb /asn.mmdb
EXPOSE 8080
VOLUME /data
USER nonroot:nonroot
ENTRYPOINT ["/speedtest"]