# Template, NOT built in this article. Pass an independently verified digest.
# Example shape: registry.example/approved-go@sha256:<64 hex digits>
ARG GO_IMAGE
FROM ${GO_IMAGE} AS build
WORKDIR /src
COPY go.mod ./
COPY main.go ./
RUN CGO_ENABLED=0 go build -trimpath -buildvcs=false -o /out/app .
FROM scratch
COPY --from=build --chown=65532:65532 /out/app /app
USER 65532:65532
ENTRYPOINT ["/app"]