[compscidr]

Closes #680

• Build stage: golang:1.26.1-trixie (same as before; pinned to trixie so it can't drift from the runtime glibc).
• Runtime: debian:trixie-slim + ca-certificates, the binary, www/, themes/, templates/.
• glibc base kept because cgo is required (SQLite, Go .so plugins).
• WORKDIR is still /go/src/github.com/compscidr/goblog, so existing bind mounts and docker exec <container> ./goblog reset-admin-password / validate-plugin are unaffected.

Tested locally: image is 152 MB; scripts/install-smoke-test.sh passes for sqlite, mysql, postgres and legacy sqlite, unchanged.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

🔵 Needs a closer look

It swaps the production runtime base image, an operational change whose correctness depends on the Docker build and smoke test that cannot be executed in this review, so it warrants human verification.

1 open issue

• Build comment wrongly says Go plugins need cgo · New

What changed in this PR

This PR converts the single-stage Dockerfile into a multi-stage build to shrink the published image from ~1.65 GB to ~152 MB (closes #680). The compile happens in the golang toolchain image, and only the resulting binary plus the files goblog reads from its working directory at runtime (www/, themes/, templates/) are copied into a slim Debian runtime base. A glibc-based runtime (pinned to the same Debian release as the builder) is retained because the SQLite driver is compiled with cgo, and ca-certificates is installed for outgoing HTTPS.

Changes:

• Split into a build stage (golang:1.26.1-trixie) and a runtime stage (debian:trixie-slim), copying only the binary and runtime asset directories.
• Install ca-certificates in the runtime stage for outbound TLS (OAuth, plugin directory, SMTP).
• Preserve the existing WORKDIR/ENTRYPOINT so bind mounts and docker exec <container> ./goblog … keep working.

File	Description
Dockerfile	Introduces a multi-stage build: compile in the Go image, then ship the binary + www//themes//templates/ on a slim glibc Debian base with ca-certificates, keeping the prior working directory and entrypoint.

I verified that www/, templates/shared/, and themes/default/ are the only runtime-read directories (plugin templates and docs content are go:embed'd), that cgo is genuinely required for mattn/go-sqlite3, and that the build/runtime bases share the trixie glibc. The change looks functionally sound; the one note below is a minor comment-accuracy nit.

_{Review effort: Balanced}