# Static Go control binaries plus a static busybox so RootOps shell can
# exec /bin/sh inside Controller allocations. Base stays scratch (no package
# manager / shared libs) for a small attack surface and offline-friendly builds.
FROM scratch

COPY --chmod=0755 docker/controller-runtime/.build/friend-agent /usr/local/bin/friend-agent
COPY --chmod=0755 docker/controller-runtime/.build/friend-cluster-host /usr/local/bin/friend-cluster-host
COPY --chmod=0755 docker/controller-runtime/.build/friend-controller-runtime /usr/local/bin/friend-controller-runtime
COPY --chmod=0755 docker/controller-runtime/.build/busybox /bin/busybox
COPY --chmod=0755 docker/controller-runtime/.build/busybox /bin/sh
COPY docker/controller-runtime/passwd /etc/passwd
COPY docker/controller-runtime/group /etc/group

ENTRYPOINT ["/usr/local/bin/friend-controller-runtime"]
