ARG GO_IMAGE=docker.io/library/golang:1.27.2-alpine3.24@sha256:85dc1069ac644ea3c527b177303a406eb3358192816cd7f9e5848eb658851673
ARG UPSTREAM=docker.io/grafana/alloy@sha256:2aa2099af76c0098d4af7a4d6e48f86cb66dc1a000222ad927a1c67c6542d13f
ARG UBUNTU_IMAGE=public.ecr.aws/ubuntu/ubuntu:noble@sha256:748740465d0aadaa69ab6e6c295892f17d7a8f44a85090dbb571ec0bb8c5674f
# Prepared, checksum-bound source artifact; load its retained OCI instead of rebuilding it.
ARG BEYLA_IMAGE=localhost/hardened-source/alloy-beyla:v3.35.0-batch3-slice9
FROM ${GO_IMAGE} AS go-sdk
FROM ${BEYLA_IMAGE} AS beyla
FROM ${UBUNTU_IMAGE} AS build
LABEL io.thepeoples.hardened.build-owner="hardened-batch3-slice11"
ARG DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get install -qy --no-install-recommends \
    build-essential ca-certificates curl libsystemd-dev pkg-config xz-utils \
 && apt-get clean && rm -rf /var/lib/apt/lists/*
COPY --from=go-sdk /usr/local/go /usr/local/go
ARG NODE_URL=https://nodejs.org/dist/v24.16.0/node-v24.16.0-linux-x64.tar.xz
ARG NODE_SHA256=d804845d34eddc21dc1092b519d643ef40b1f58ec5dec5c22b1f4bd8fabde6c9
RUN curl -fsSL "$NODE_URL" -o /tmp/node.tar.xz \
 && printf '%s  %s\n' "$NODE_SHA256" /tmp/node.tar.xz | sha256sum -c - \
 && mkdir /usr/local/node && tar -xJf /tmp/node.tar.xz --strip-components=1 -C /usr/local/node
ENV PATH=/usr/local/go/bin:/usr/local/node/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
ENV GOWORK=off GOTOOLCHAIN=local CGO_ENABLED=1 GOOS=linux GOARCH=amd64 \
    CC=gcc CXX=g++ GOMAXPROCS=2 GOMEMLIMIT=3GiB \
    GOCACHE=/cache/build GOMODCACHE=/cache/mod GOTMPDIR=/cache/tmp
ARG SOURCE_URL=https://codeload.github.com/grafana/alloy/tar.gz/95e12cf8961fabc9db6858f7e79bde5c814a07a0
ARG SOURCE_SHA256=3eb1fa18f4501dd6153c1c06fd58eb419ff10b8ada01cadc418bfbb6a2be7a5a
WORKDIR /src
RUN curl -fsSL "$SOURCE_URL" -o /tmp/upstream.tar.gz \
 && printf '%s  %s\n' "$SOURCE_SHA256" /tmp/upstream.tar.gz | sha256sum -c - \
 && tar -xzf /tmp/upstream.tar.gz --strip-components=1 -C /src
COPY --from=beyla /bin/beyla /tmp/beyla
COPY --chmod=0755 build-alloy.sh /usr/local/bin/build-alloy
ARG SOURCE_COMMIT=95e12cf8961fabc9db6858f7e79bde5c814a07a0
ARG VERSION=v1.20.1
ARG BUILD_DATE=2026-09-28T17:54:43Z
ARG BEYLA_SHA256=345bbae31c990c05f688cd3fc4a6a7715f19b40d9fca4cd5b8b69b35e9ed060d
ARG GO_BUMPS="golang.org/x/net@v0.60.0 golang.org/x/crypto@v0.57.0"
RUN /usr/local/bin/build-alloy
FROM scratch AS source
LABEL io.thepeoples.hardened.build-owner="hardened-batch3-slice11"
COPY --from=build /out/source/ /
FROM ${UBUNTU_IMAGE}
ARG UPSTREAM
ARG DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get upgrade -qy \
 && apt-get install -qy --no-install-recommends ca-certificates libsystemd0 libstdc++6 tzdata \
 && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
COPY --from=build --chown=473:473 --chmod=0755 /out/bin/alloy /usr/bin/alloy
COPY --from=build --chown=473:473 /src/example-config.alloy /etc/alloy/config.alloy
COPY --from=build --chown=473:473 --chmod=0755 /src/packaging/docker/otelcol.sh /usr/bin/otelcol
COPY --from=build --chown=473:473 --chmod=0755 /src/packaging/docker/otel-supervisor.sh /usr/bin/otel-supervisor
COPY --from=build /out/records/ /usr/share/tp-hardened/alloy/
RUN groupadd --gid 473 alloy && useradd -m -u 473 -g 473 alloy \
 && mkdir -p /var/lib/alloy/data /var/lib/alloy/supervisor \
 && chown -R 473:473 /var/lib/alloy && chmod -R 770 /var/lib/alloy
ENV ALLOY_DEPLOY_MODE=docker
ENTRYPOINT ["/bin/alloy"]
CMD ["run", "/etc/alloy/config.alloy", "--storage.path=/var/lib/alloy/data"]
LABEL org.opencontainers.image.version="v1.20.1" \
      org.opencontainers.image.source="https://github.com/grafana/alloy" \
      org.opencontainers.image.revision="95e12cf8961fabc9db6858f7e79bde5c814a07a0" \
      org.opencontainers.image.licenses="Apache-2.0" \
      io.thepeoples.hardened.upstream="${UPSTREAM}" \
      io.thepeoples.hardened.toolchain="go1.27.2" \
      io.thepeoples.hardened.source-status="source offers and parent/nested validation pending"