BOC v1.0: RS256 auth, Ledger integration, Prometheus metrics, CI/CD, backup

backend/Dockerfile

@@ -1,5 +1,7 @@
-# Build stage
-FROM golang:1.25-alpine AS builder
+# BOC Backend Dockerfile
+# Multi-stage build for minimal image
+
+FROM golang:1.22-alpine AS builder
 
 WORKDIR /app
 
@@ -10,31 +12,32 @@ RUN apk add --no-cache git
 COPY go.mod go.sum ./
 RUN go mod download
 
-# Copy source code
+# Copy source
 COPY . .
 
-# Build the binary
+# Build
 RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o boc .
 
 # Final stage
 FROM alpine:latest
 
-RUN apk --no-cache add ca-certificates wget
+RUN apk --no-cache add ca-certificates
 
-WORKDIR /root/
+WORKDIR /app
 
-# Copy binary from builder
+# Copy binary
 COPY --from=builder /app/boc .
-
-# Copy migrations
 COPY --from=builder /app/db/migrations ./db/migrations
 
-# Expose port
+# Create non-root user
+RUN addgroup -g 1000 -S boc && \
+    adduser -u 1000 -S boc -G boc
+
+USER boc
+
 EXPOSE 9092
 
-# Health check
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
-  CMD wget -q --spider http://localhost:9092/health || exit 1
+    CMD wget -qO- http://localhost:9092/health || exit 1
 
-# Run the binary
 CMD ["./boc"]