# KNELSecretsManager Go CLI — pure Go (no upstream Rust binary, no Node).
FROM golang:1.23-alpine AS build
WORKDIR /src
COPY cli/go.mod cli/go.sum ./
COPY cli/cmd/ ./cmd/
RUN go build -ldflags="-s -w" -o /out/smcli ./cmd/smcli

FROM alpine:3.20
RUN apk add --no-cache ca-certificates && adduser -D -u 65532 app
COPY --from=build /out/smcli /usr/local/bin/smcli
USER 65532:65532