Dockerfile

# Build the manager binary
FROM golang:1.25 AS builder
ARG TARGETOS
ARG TARGETARCH

WORKDIR /workspace
# Copy the Go Modules manifests
COPY go.mod go.mod
COPY go.sum go.sum
# cache deps before building and copying source so that we don't need to re-download as much
# and so that source changes don't invalidate our downloaded layer
RUN go mod download

# Copy the Go source (relies on .dockerignore to filter)
COPY . .

# Build
# the GOARCH has no default value to allow the binary to be built according to the host where the command
# was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO
# the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
# by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o controller ./cmd/controller
RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o apiserver  ./cmd/apiserver
RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o satellite  ./cmd/satellite

# The satellite needs to shell out to drbdadm/lvs/zfs/cryptsetup, none
# of which are in distroless:static. We use debian-slim for it (and let
# the controller image stay distroless for the smaller surface). The
# manager is what ships under "blockstor:dev"; the satellite ships under
# "blockstor-satellite:dev".
FROM gcr.io/distroless/static:nonroot AS controller
WORKDIR /
COPY --from=builder /workspace/controller .
USER 65532:65532
ENTRYPOINT ["/controller"]

# The apiserver is the LINSTOR-compatible REST front-end split out
# of the controller (Phase 11). It runs N replicas behind a Service
# and serves linstor-csi / `linstor` CLI / piraeus-operator. Same
# distroless surface as the controller — no shell-outs.
FROM gcr.io/distroless/static:nonroot AS apiserver
WORKDIR /
COPY --from=builder /workspace/apiserver .
USER 65532:65532
ENTRYPOINT ["/apiserver"]

FROM debian:trixie-slim AS satellite
# zfsutils-linux is in contrib on trixie — enable it so we can pull
# zpool/zfs alongside drbd-utils, lvm2, cryptsetup. Note: the kernel
# module is provided by the host (Talos siderolabs/zfs extension);
# this image only ships the userspace tools.
RUN sed -i 's|^Components: main$|Components: main contrib|' /etc/apt/sources.list.d/debian.sources && \
    apt-get update -qq && \
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
        drbd-utils lvm2 cryptsetup-bin zfsutils-linux gdisk parted ca-certificates \
        iptables && \
    rm -rf /var/lib/apt/lists/*
WORKDIR /
COPY --from=builder /workspace/satellite /usr/local/bin/satellite
ENTRYPOINT ["/usr/local/bin/satellite"]