From 250a40f58fdbdd7691456a3a67c0194142b34a57 Mon Sep 17 00:00:00 2001
From: Pierre Rousset <pierre@curvegrid.com>
Date: Sun, 29 Mar 2026 13:57:02 +0900
Subject: [PATCH 1/2] Make Dockerfile multi-arch buildx friendly

---
 .dockerignore | 12 ++++++++++++
 Dockerfile    | 41 ++++++++++++++++++++++++++++++++++-------
 2 files changed, 46 insertions(+), 7 deletions(-)

diff --git a/.dockerignore b/.dockerignore
index b222fb5a..e6f0bcc0 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -3,6 +3,7 @@
 *.dll
 *.so
 *.dylib
+vouch
 
 # Test binary, build with `go test -c`
 *.test
@@ -20,4 +21,15 @@ coverage.html
 # Local TODO
 TODO.md
 
+# VCS and editor metadata
+.git
+.gitignore
+.github
+.idea
+.vscode
+.DS_Store
+
+# Logs
+*.log
+
 Dockerfile
diff --git a/Dockerfile b/Dockerfile
index c2a7be96..1f7eeeec 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,21 +1,48 @@
-FROM golang:1.25-bookworm AS builder
+FROM --platform=$BUILDPLATFORM golang:1.25-bookworm AS builder
 
 WORKDIR /app
 
+ARG BUILDARCH
+RUN <<-EOF
+    set -e
+    packages=""
+    case "$BUILDARCH" in
+        amd64) packages="$packages gcc-aarch64-linux-gnu g++-aarch64-linux-gnu" ;;
+        arm64) packages="$packages gcc-x86-64-linux-gnu g++-x86-64-linux-gnu" ;;
+        *) echo "unsupported build architecture: $BUILDARCH" >&2; exit 1 ;;
+    esac
+    apt-get update
+    DEBIAN_FRONTEND=noninteractive apt-get install -y $packages
+    apt-get clean
+    rm -rf /var/lib/apt/lists/*
+EOF
+
 COPY go.mod go.sum ./
 
 RUN go mod download
 
 COPY . .
 
-RUN go build
-
-FROM debian:bookworm-slim
-
-RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt install -y ca-certificates && apt-get clean && rm -rf /var/lib/apt/lists/*
+ARG TARGETOS
+ARG TARGETARCH
+RUN <<-EOF
+    set -e
+    if [ "$BUILDARCH" = "$TARGETARCH" ]; then
+        export CC=gcc CXX=g++
+    else
+        case "$TARGETARCH" in
+            amd64) export CC=x86_64-linux-gnu-gcc CXX=x86_64-linux-gnu-g++ ;;
+            arm64) export CC=aarch64-linux-gnu-gcc CXX=aarch64-linux-gnu-g++ ;;
+            *) echo "unsupported target architecture: $TARGETARCH" >&2; exit 1 ;;
+        esac
+    fi
+    CGO_ENABLED=1 GOOS=$TARGETOS GOARCH=$TARGETARCH CC=$CC CXX=$CXX go build -o /app/vouch .
+EOF
+
+FROM gcr.io/distroless/base-debian12:nonroot
 
 WORKDIR /app
 
-COPY --from=builder /app/vouch /app
+COPY --from=builder /app/vouch /app/vouch
 
 ENTRYPOINT ["/app/vouch"]

From d8c971426093b6ee6fc27a99eaa5b836fbc3b7b2 Mon Sep 17 00:00:00 2001
From: Pierre Rousset <pierre@curvegrid.com>
Date: Thu, 2 Apr 2026 17:17:33 +0900
Subject: [PATCH 2/2] Revert distroless runtime image

---
 Dockerfile | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 1f7eeeec..70535565 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -39,7 +39,9 @@ RUN <<-EOF
     CGO_ENABLED=1 GOOS=$TARGETOS GOARCH=$TARGETARCH CC=$CC CXX=$CXX go build -o /app/vouch .
 EOF
 
-FROM gcr.io/distroless/base-debian12:nonroot
+FROM debian:bookworm-slim
+
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt install -y ca-certificates && apt-get clean && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app