ARG GO_IMAGE=docker.io/library/golang:1.27.2-alpine3.24@sha256:85dc1069ac644ea3c527b177303a406eb3358192816cd7f9e5848eb658851673
ARG UPSTREAM=quay.io/prometheus/prometheus@sha256:efd719c99d83b060d9daefdcf00360461adf279f45ef5391f8d111892118753e
FROM ${UPSTREAM} AS original
FROM ${GO_IMAGE} AS build
LABEL io.thepeoples.hardened.build-owner="hardened-batch3-slice4"
ARG SOURCE_URL=https://codeload.github.com/prometheus/prometheus/tar.gz/5241a27fe3c6983549fccc32f6e65917408c63cd
ARG SOURCE_SHA256=eee7ec029ffdba7d9ee59171cad5ddaff10e71514b0bae1a6fde6dc1ae99e181
ARG SOURCE_COMMIT=5241a27fe3c6983549fccc32f6e65917408c63cd
ARG VERSION=3.15.0
ARG BUILD_DATE=2026-09-25T08:56:22Z
ARG GO_BUMPS="golang.org/x/net@v0.60.0 golang.org/x/crypto@v0.57.0"
ARG UI_URL=https://github.com/prometheus/prometheus/releases/download/v3.15.0/prometheus-web-ui-3.15.0.tar.gz
ARG UI_SHA256=fa8c918ed05e3f89e232e9b69eccd6ed074602cd9e8a2cab7a92bec9651974ae
ENV GOWORK=off GOTOOLCHAIN=local CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOMAXPROCS=4
WORKDIR /src
RUN wget -q -O /tmp/upstream.tar.gz "${SOURCE_URL}" \
 && printf '%s  %s\n' "${SOURCE_SHA256}" /tmp/upstream.tar.gz | sha256sum -c - \
 && tar -xzf /tmp/upstream.tar.gz --strip-components=1 -C /src
RUN wget -q -O /tmp/web-ui.tar.gz "${UI_URL}" \
 && printf '%s  %s\n' "${UI_SHA256}" /tmp/web-ui.tar.gz | sha256sum -c - \
 && tar -xzf /tmp/web-ui.tar.gz -C web/ui \
 && cd web/ui \
 && cp embed.go.tmpl embed.go \
 && find static -type f ! -name '*.gz' -exec gzip -f -n {} \; \
 && find static -type f -name '*.gz' | LC_ALL=C sort | xargs echo //go:embed >> embed.go \
 && echo 'var EmbedFS embed.FS' >> embed.go
RUN mkdir -p /out/bin /out/records /out/source \
 && cp go.mod /out/records/upstream.go.mod \
 && cp go.sum /out/records/upstream.go.sum \
 && if [ -n "${GO_BUMPS}" ]; then go get ${GO_BUMPS}; fi \
 && go mod download \
 && go mod verify \
 && go build -p 4 -tags netgo,builtinassets -mod=readonly -buildvcs=false -trimpath -ldflags "-s -w -X github.com/prometheus/common/version.Version=${VERSION} -X github.com/prometheus/common/version.Revision=${SOURCE_COMMIT} -X github.com/prometheus/common/version.Branch=hardened -X github.com/prometheus/common/version.BuildUser=thepeoples.io -X github.com/prometheus/common/version.BuildDate=${BUILD_DATE}" -o /out/bin/ ./cmd/prometheus ./cmd/promtool \
 && go version -m /out/bin/prometheus > /out/records/go-version-m.txt \
 && go version -m /out/bin/promtool > /out/records/promtool-go-version-m.txt \
 && go list -m -json all > /out/records/modules.json \
 && printf '%s\n' "${SOURCE_COMMIT}" > /out/records/upstream-commit \
 && printf '%s\n' "${GO_BUMPS}" > /out/records/bumps \
 && cp go.mod go.sum LICENSE /out/records/ \
 && mkdir /out/licenses && cp LICENSE /out/licenses/ \
 && if [ -f NOTICE ]; then cp NOTICE /out/records/ && cp NOTICE /out/licenses/; fi \
 && go mod vendor \
 && tar -czf /out/source/vendor.tar.gz vendor \
 && cp /tmp/upstream.tar.gz /out/source/upstream.tar.gz \
 && cp /tmp/web-ui.tar.gz /out/source/web-ui.tar.gz \
 && cp -R /out/records /out/source/records \
 && cd /out/source && sha256sum upstream.tar.gz vendor.tar.gz web-ui.tar.gz records/* > SHA256SUMS
FROM scratch AS source
LABEL io.thepeoples.hardened.build-owner="hardened-batch3-slice4"
COPY --from=build /out/source/ /
FROM scratch
COPY --from=original /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=original /etc/passwd /etc/group /etc/nsswitch.conf /etc/
COPY --from=original --chown=65534:65534 /etc/prometheus/ /etc/prometheus/
COPY --from=original --chown=65534:65534 /prometheus/ /prometheus/
COPY --from=build --chmod=0755 /out/bin/ /bin/
COPY --from=build /out/records/ /usr/share/tp-hardened/prometheus/
COPY --from=build /out/licenses/ /usr/share/tp-hardened/prometheus/licenses/
USER 65534:65534
WORKDIR /prometheus
VOLUME ["/prometheus"]
EXPOSE 9090
ENTRYPOINT ["/bin/prometheus"]
CMD ["--config.file=/etc/prometheus/prometheus.yml", "--storage.tsdb.path=/prometheus"]
LABEL org.opencontainers.image.version="v3.15.0" \
      org.opencontainers.image.source="https://github.com/prometheus/prometheus" \
      org.opencontainers.image.revision="5241a27fe3c6983549fccc32f6e65917408c63cd" \
      org.opencontainers.image.licenses="Apache-2.0" \
      io.thepeoples.hardened.upstream="quay.io/prometheus/prometheus:v3.15.0@sha256:efd719c99d83b060d9daefdcf00360461adf279f45ef5391f8d111892118753e" \
      io.thepeoples.hardened.ladder="b+minimize" \
      io.thepeoples.hardened.toolchain="go1.27.2" \
      io.thepeoples.hardened.source-status="export vendor and runtime asset sources before publication"