Dockerfile.postgres

# Chainguard PostgreSQL build
FROM cgr.dev/chainguard/postgres:latest

# Metadata for tracking
LABEL security.base="chainguard"
LABEL security.scan-date="AUTO_GENERATED"
LABEL security.patch-level="minimal-attack-surface"
LABEL maintainer="TMI Security Team"
LABEL org.opencontainers.image.title="TMI PostgreSQL Chainguard"
LABEL org.opencontainers.image.description="PostgreSQL on Chainguard secure base"

# Environment variables for PostgreSQL
ENV PGDATA=/var/lib/postgresql/data
ENV LANG=en_US.UTF-8
ENV LC_ALL=en_US.UTF-8

# Expose PostgreSQL port
EXPOSE 5432

# Health check - no user specified since pg_isready just checks connection availability
HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
    CMD ["pg_isready", "-h", "localhost"]

# Use postgres user (Chainguard images already have proper user setup)
USER postgres

# Chainguard PostgreSQL images come with built-in entrypoint
# No custom entrypoint needed as Chainguard provides secure defaults