FROM alpine:latest

WORKDIR /app

# Copy in your prebuilt Go binary (from local ./backend/bin/backend)
COPY bin/backend ./backend

# Secrets are injected at runtime via compose env_file / environment (see
# docker-compose.yml backend env_file: ./.env) — NEVER baked into the image.

EXPOSE 8080

ENTRYPOINT ["./backend"]