Dockerfile

FROM --platform=$BUILDPLATFORM golang:1.24.6-alpine AS helper-tool
COPY helper/ ./
RUN CGO_ENABLED=0 go build -ldflags "-w -s" -o /build-image

FROM alpine:3.22 AS download-trivy
# renovate: datasource=github-releases depName=trivy packageName=aquasecurity/trivy
ARG TRIVY_VERSION=0.65.0
WORKDIR /app
RUN apk add --no-cache curl tar && \
    curl -L https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz | tar -zxvf -

FROM moby/buildkit:v0.23.2-rootless
USER root
ENV BUILDKIT_COLORS=run=green:warning=yellow:error=red:cancel=255,165,0
RUN mkdir /etc/buildkit && \
    chown user:user /etc/buildkit
COPY --from=helper-tool /build-image /usr/local/bin/build-image
COPY --from=download-trivy /app/ /trivy
USER user
ENTRYPOINT [ "ash" ]