Dockerfile

# ---- Builder stage ----
FROM golang:1.25-bookworm AS builder

RUN apt-get update && apt-get install -y --no-install-recommends \
    libdlib-dev \
    libatlas-base-dev \
    libjpeg62-turbo-dev \
    build-essential \
    cmake \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

COPY go.mod go.sum ./
RUN go mod download

COPY . .
RUN CGO_ENABLED=1 GOOS=linux go build -ldflags="-s -w" -o face-service main.go

# ---- Runtime stage ----
FROM debian:bookworm-slim

RUN apt-get update && apt-get install -y --no-install-recommends \
    libdlib19.1 \
    libopenblas0-serial \
    liblapack3 \
    libjpeg62-turbo \
    ca-certificates \
    curl \
    && rm -rf /var/lib/apt/lists/* \
    && apt-get clean

WORKDIR /app

# Create data directory for SQLite (as root, before switching user)
RUN mkdir -p /app/data && chmod 755 /app/data

COPY --from=builder /app/face-service /app/face-service

COPY models/mmod_human_face_detector.dat /app/models/
COPY models/shape_predictor_5_face_landmarks.dat /app/models/
COPY models/dlib_face_recognition_resnet_model_v1.dat /app/models/

# Set ownership for appuser
RUN chown -R appuser:appuser /app

# Switch to non-root user
USER appuser

HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
    CMD curl -f http://localhost:8082/health || exit 1

EXPOSE 8082

CMD ["/app/face-service"]