Dockerfile

# =============================================================================
# TelemetryFlow Collector - Dockerfile (Native Go Build)
# =============================================================================
#
# TelemetryFlow Collector v1.3.0 (Based on OpenTelemetry Collector Builder (OCB) 0.152.0)
# AI-Powered Observability & Incident Response Management (IRM) Platform
# Copyright (c) 2026 Telemetri Data Indonesia. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# =============================================================================
# Native Go Build with Custom TFO Components
# =============================================================================
#
# This Dockerfile builds the TFO Collector directly from source with custom
# TFO components:
#   - tfootlp receiver (v1/v2 endpoint support)
#   - tfo exporter (auto TFO auth injection)
#   - tfoauth extension (API key management)
#   - tfoidentity extension (collector identity)
#
# OTLP HTTP Endpoints:
#   v1 (Community/Open - NO AUTH): /v1/traces, /v1/metrics, /v1/logs
#   v2 (TFO Platform - AUTH):      /v2/traces, /v2/metrics, /v2/logs
#
# =============================================================================

# -----------------------------------------------------------------------------
# Stage 1: Builder
# -----------------------------------------------------------------------------
FROM --platform=$BUILDPLATFORM golang:1.26-alpine AS builder

# Build arguments
ARG VERSION=1.3.0
ARG GIT_COMMIT=unknown
ARG GIT_BRANCH=unknown
ARG BUILD_TIME=unknown
ARG OTEL_VERSION=0.152.0
ARG TARGETOS=linux
ARG TARGETARCH

# Install build dependencies
RUN apk add --no-cache \
    git \
    make \
    ca-certificates \
    tzdata \
    curl

# Set working directory
WORKDIR /build

# Copy go mod files first for better caching
COPY go.mod go.sum ./

# Copy components (needed for replace directives in go.mod)
COPY components/ ./components/

# Download dependencies
RUN go mod download

# Copy the rest of the source code
COPY cmd/ ./cmd/
COPY internal/ ./internal/

# Build the binary
# Uses TARGETOS/TARGETARCH for multi-arch support (amd64, arm64)
RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \
    -ldflags "-s -w \
    -X 'github.com/telemetryflow/telemetryflow-collector/internal/version.Version=${VERSION}' \
    -X 'github.com/telemetryflow/telemetryflow-collector/internal/version.GitCommit=${GIT_COMMIT}' \
    -X 'github.com/telemetryflow/telemetryflow-collector/internal/version.GitBranch=${GIT_BRANCH}' \
    -X 'github.com/telemetryflow/telemetryflow-collector/internal/version.BuildTime=${BUILD_TIME}'" \
    -o /tfo-collector ./cmd/tfo-collector

# -----------------------------------------------------------------------------
# Stage 2: Runtime
# -----------------------------------------------------------------------------
FROM alpine:3.23

# Build arguments for labels
ARG VERSION=1.3.0
ARG OTEL_VERSION=0.152.0

# =============================================================================
# TelemetryFlow Metadata Labels (OCI Image Spec)
# =============================================================================
LABEL org.opencontainers.image.title="TelemetryFlow Collector" \
    org.opencontainers.image.description="Enterprise-grade OpenTelemetry Collector - AI-Powered Observability & Incident Response Management (IRM) Platform" \
    org.opencontainers.image.version="${VERSION}" \
    org.opencontainers.image.vendor="TelemetryFlow" \
    org.opencontainers.image.authors="Telemetri Data Indonesia <support@telemetryflow.id>" \
    org.opencontainers.image.url="https://telemetryflow.id" \
    org.opencontainers.image.documentation="https://docs.telemetryflow.id" \
    org.opencontainers.image.source="https://github.com/telemetryflow/telemetryflow-collector" \
    org.opencontainers.image.licenses="Apache-2.0" \
    org.opencontainers.image.base.name="alpine:3.23" \
    # TelemetryFlow specific labels
    io.telemetryflow.product="TelemetryFlow Collector" \
    io.telemetryflow.component="tfo-collector" \
    io.telemetryflow.platform="CEOP" \
    io.telemetryflow.build.type="native" \
    io.telemetryflow.otel.version="${OTEL_VERSION}" \
    io.telemetryflow.maintainer="Telemetri Data Indonesia"

# Update all packages for security patches (CVE fixes) and install runtime dependencies
# SECURITY: apk upgrade ensures all base packages are patched against known CVEs
# (zlib CVE-2026-22184/CVE-2026-27171, libcrypto/libssl patches, musl libc fixes, etc.)
RUN apk upgrade --no-cache --available && \
    apk add --no-cache \
    ca-certificates \
    tzdata \
    curl \
    && apk del --purge apk-tools 2>/dev/null || true \
    && rm -rf /var/cache/apk/* /etc/apk /lib/apk

# Create non-root user and group
RUN addgroup -g 10001 -S telemetryflow && \
    adduser -u 10001 -S telemetryflow -G telemetryflow -h /home/telemetryflow

# Create required directories
RUN mkdir -p \
    /etc/tfo-collector \
    /var/lib/tfo-collector/queue \
    /var/log/tfo-collector \
    /tmp/tfo-collector \
    && chown -R telemetryflow:telemetryflow \
    /etc/tfo-collector \
    /var/lib/tfo-collector \
    /var/log/tfo-collector \
    /tmp/tfo-collector

# Copy binary from builder
COPY --from=builder /tfo-collector /usr/local/bin/tfo-collector
RUN chmod +x /usr/local/bin/tfo-collector

# Copy default configuration
COPY configs/tfo-collector.yaml /etc/tfo-collector/tfo-collector.yaml
RUN chown telemetryflow:telemetryflow /etc/tfo-collector/tfo-collector.yaml

# Switch to non-root user
USER telemetryflow

# Set working directory
WORKDIR /home/telemetryflow

# Set TMPDIR for Go runtime temp files
ENV TMPDIR=/tmp/tfo-collector

# =============================================================================
# Exposed Ports
# =============================================================================
# 4317  - OTLP gRPC receiver
# 4318  - OTLP HTTP receiver (v1 + v2 endpoints)
# 8888  - Prometheus metrics (self-observability)
# 8889  - Prometheus exporter
# 13133 - Health check endpoint
# 55679 - zPages debugging
# 1777  - pprof profiling
EXPOSE 4317 4318 8888 8889 13133 55679 1777

# =============================================================================
# Health Check
# =============================================================================
HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
    CMD curl -f http://localhost:13133/ || exit 1

# =============================================================================
# Entrypoint & Command
# =============================================================================
ENTRYPOINT ["/usr/local/bin/tfo-collector"]
CMD ["-c", "/etc/tfo-collector/tfo-collector.yaml"]

# =============================================================================
# Build Information
# =============================================================================
# Build with:
#   docker build \
#     --build-arg VERSION=1.3.0 \
#     --build-arg GIT_COMMIT=$(git rev-parse --short HEAD) \
#     --build-arg GIT_BRANCH=$(git rev-parse --abbrev-ref HEAD) \
#     --build-arg BUILD_TIME=$(date -u '+%Y-%m-%dT%H:%M:%SZ') \
#     --build-arg OTEL_VERSION=0.152.0 \
#     -t telemetryflow/telemetryflow-collector:1.3.0 .
#
# Run with:
#   docker run -d \
#     --name tfo-collector \
#     -p 4317:4317 \
#     -p 4318:4318 \
#     -p 8888:8888 \
#     -p 13133:13133 \
#     -e TELEMETRYFLOW_API_KEY_ID=tfk_your_key \
#     -e TELEMETRYFLOW_API_KEY_SECRET=tfs_your_secret \
#     -v /path/to/config.yaml:/etc/tfo-collector/tfo-collector.yaml:ro \
#     telemetryflow/telemetryflow-collector:1.3.0
#
# Validate config:
#   docker run --rm \
#     -v /path/to/config.yaml:/etc/tfo-collector/tfo-collector.yaml:ro \
#     telemetryflow/telemetryflow-collector:1.3.0 \
#     validate -c /etc/tfo-collector/tfo-collector.yaml
# =============================================================================