ARG GO_IMAGE=docker.io/library/golang:1.26.9-alpine3.24@sha256:397ecc648150dd585f1734dfcd8d1bb4746664e54464191d77ad0ecffaf38bdb
FROM ${GO_IMAGE} AS build
# The build resolves every module from the retained sources with network disabled.
WORKDIR /offer
COPY . /offer/
RUN sha256sum -c SHA256SUMS \
 && mkdir -p /work/gopath /work/cache /work/mod/cache/download /work/tmp /work/generated /out/bin \
 && for archive in module-inputs-[0-9][0-9][0-9].tar.gz; do tar -xzf "$archive" -C /work/mod/cache/download; done \
 && tar -xzf graph-metadata.tar.gz -C /work/mod/cache/download \
 && cp offline-builder-list.txt /work/mod/cache/download/go.opentelemetry.io/collector/cmd/builder/@v/list \
 && tar -xzf generated.tar.gz -C /work/generated
ENV GOWORK=off GOTOOLCHAIN=local CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOMAXPROCS=4 \
    GOPATH=/work/gopath GOCACHE=/work/cache GOMODCACHE=/work/mod GOTMPDIR=/work/tmp GOPROXY=file:///work/mod/cache/download GOSUMDB=off
WORKDIR /work/generated
RUN test "$(go version)" = 'go version go1.26.9 linux/amd64' \
 && go mod download && go mod verify \
 && go install -trimpath go.opentelemetry.io/collector/cmd/builder@v0.162.0 \
 && cp /work/gopath/bin/builder /out/bin/builder \
 && go build -p 4 -tags grpcnotrace -mod=readonly -buildvcs=false -trimpath -ldflags '-s -w' -o /out/bin/otelcol-k8s . \
 && cd /out/bin && sha256sum -c /offer/expected-binaries.sha256
FROM scratch
COPY --from=build /offer/records/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=build /offer/config.yaml /etc/otelcol-k8s/config.yaml
COPY --from=build --chmod=0755 /out/bin/otelcol-k8s /otelcol-k8s
COPY --from=build /offer/records/ /usr/share/tp-hardened/opentelemetry-collector/
USER 10001:10001
WORKDIR /
EXPOSE 4317 4318
ENTRYPOINT ["/otelcol-k8s"]
CMD ["--config", "/etc/otelcol-k8s/config.yaml"]
LABEL org.opencontainers.image.version="0.162.0" \
      org.opencontainers.image.source="https://github.com/open-telemetry/opentelemetry-collector-releases" \
      org.opencontainers.image.revision="f6159a775dad1e21433c49bd8450673dd13ed4d3" \
      org.opencontainers.image.licenses="Apache-2.0" \
      io.thepeoples.hardened.toolchain="go1.26.9" \
      io.thepeoples.hardened.distribution="full official k8s" \
      io.thepeoples.hardened.source-status="offline corresponding-source rebuild; normal release integration pending"