ARG GO_IMAGE=docker.io/library/golang:1.27.2-alpine3.24@sha256:85dc1069ac644ea3c527b177303a406eb3358192816cd7f9e5848eb658851673
ARG UPSTREAM=docker.io/grafana/loki@sha256:1107dd5274e0ada47e42472b7a7e71f3b2a2fe878878108f3e2f9e51528f0193
FROM ${UPSTREAM} AS original
FROM ${GO_IMAGE} AS build
LABEL io.thepeoples.hardened.build-owner="hardened-batch3-slice8"
ARG SOURCE_URL=https://codeload.github.com/grafana/loki/tar.gz/09e6ce2ff1bdc19763a10265b870c86f51c98655
ARG SOURCE_SHA256=44c1433b8c5e9638708e62644aa43a746f991206acef5889eaec620a895813b8
ARG SOURCE_COMMIT=09e6ce2ff1bdc19763a10265b870c86f51c98655
ARG VERSION=3.7.8
ARG BUILD_DATE=2026-09-17T13:46:29Z
ENV GOWORK=off GOTOOLCHAIN=local CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOMAXPROCS=4 GOCACHE=/go/cache GOMODCACHE=/go/pkg/mod
WORKDIR /src
RUN wget -q -O /tmp/upstream.tar.gz "${SOURCE_URL}" \
 && printf '%s  %s\n' "${SOURCE_SHA256}" /tmp/upstream.tar.gz | sha256sum -c - \
 && tar -xzf /tmp/upstream.tar.gz --strip-components=1 -C /src
ARG GO_BUMPS="golang.org/x/net@v0.60.0 golang.org/x/crypto@v0.57.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.45.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.45.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.45.0 go.opentelemetry.io/otel/sdk@v1.45.0 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.21.0 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.21.0 go.opentelemetry.io/otel/sdk/log@v0.21.0 go.opentelemetry.io/otel/exporters/stdout/stdoutlog@v0.21.0"
RUN mkdir -p /out/bin /out/records /out/source \
 && cp go.mod /out/records/upstream.go.mod \
 && cp go.sum /out/records/upstream.go.sum \
 && if [ -n "${GO_BUMPS}" ]; then go get ${GO_BUMPS}; fi \
 && go mod download \
 && go mod verify \
 && go build -p 4 -tags netgo -mod=readonly -buildvcs=false -trimpath -ldflags "-s -w -X github.com/grafana/loki/v3/pkg/util/build.Version=${VERSION} -X github.com/grafana/loki/v3/pkg/util/build.Revision=${SOURCE_COMMIT} -X github.com/grafana/loki/v3/pkg/util/build.Branch=hardened -X github.com/grafana/loki/v3/pkg/util/build.BuildUser=thepeoples.io -X github.com/grafana/loki/v3/pkg/util/build.BuildDate=${BUILD_DATE}" -o /out/bin/loki ./cmd/loki \
 && go version -m /out/bin/loki > /out/records/go-version-m.txt \
 && go list -mod=readonly -m -json all > /out/records/modules.json \
 && go list -mod=readonly -tags netgo -deps ./cmd/loki > /out/records/packages.txt \
 && printf '%s\n' "${SOURCE_COMMIT}" > /out/records/upstream-commit \
 && printf '%s\n' "${GO_BUMPS}" > /out/records/bumps \
 && cp go.mod go.sum LICENSE /out/records/ \
 && mkdir /out/licenses && cp LICENSE /out/licenses/ \
 && if [ -f NOTICE ]; then cp NOTICE /out/records/ && cp NOTICE /out/licenses/; fi \
 && go mod vendor \
 && tar -czf /out/source/vendor.tar.gz vendor \
 && find . -type f \( -name go.mod -o -name go.sum -o -name go.work -o -name go.work.sum \) ! -path './vendor/*' | LC_ALL=C sort > /out/records/module-manifests.list \
 && tar -czf /out/source/module-manifests.tar.gz -T /out/records/module-manifests.list \
 && cp /tmp/upstream.tar.gz /out/source/upstream.tar.gz \
 && cp -R /out/records /out/source/records \
 && cd /out/source && sha256sum upstream.tar.gz vendor.tar.gz module-manifests.tar.gz records/* > SHA256SUMS
FROM scratch AS source
LABEL io.thepeoples.hardened.build-owner="hardened-batch3-slice8"
COPY --from=build /out/source/ /
FROM ${GO_IMAGE} AS runtime-dirs
LABEL io.thepeoples.hardened.build-owner="hardened-batch3-slice8"
RUN mkdir -p /runtime/tmp && chmod 1777 /runtime/tmp
FROM scratch
ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
COPY --from=runtime-dirs /runtime/ /
COPY --from=original /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=original /etc/passwd /etc/group /etc/nsswitch.conf /etc/
COPY --from=original /usr/share/zoneinfo/ /usr/share/zoneinfo/
COPY --from=original --chown=10001:10001 /etc/loki/ /etc/loki/
COPY --from=original --chown=10001:10001 /loki/ /loki/
COPY --from=build --chmod=0755 /out/bin/loki /usr/bin/loki
COPY --from=build /out/records/ /usr/share/tp-hardened/loki/
COPY --from=build /out/licenses/ /usr/share/tp-hardened/loki/licenses/
USER 10001
WORKDIR /
EXPOSE 3100
ENTRYPOINT ["/usr/bin/loki"]
CMD ["-config.file=/etc/loki/local-config.yaml"]
LABEL org.opencontainers.image.version="3.7.8" \
      org.opencontainers.image.source="https://github.com/grafana/loki" \
      org.opencontainers.image.revision="09e6ce2ff1bdc19763a10265b870c86f51c98655" \
      org.opencontainers.image.licenses="AGPL-3.0-only" \
      io.thepeoples.hardened.upstream="docker.io/grafana/loki:3.7.8@sha256:1107dd5274e0ada47e42472b7a7e71f3b2a2fe878878108f3e2f9e51528f0193" \
      io.thepeoples.hardened.ladder="b+minimize" \
      io.thepeoples.hardened.toolchain="go1.27.2" \
      io.thepeoples.hardened.source-status="export vendor and inventory runtime assets before publication"