Publish Alpine musl distroless Postfix as the sole latest image

Dockerfile

@@ -1,58 +1,42 @@
-FROM docker.io/library/alpine:3.24
+# Compile the launcher and collect Alpine/musl Postfix runtime dependencies.
+FROM docker.io/library/alpine:3.24 AS build
+RUN apk add --no-cache postfix postfix-pcre cyrus-sasl cyrus-sasl-login ca-certificates tzdata \
+    go lddtreepax python3
+COPY install/postfix-entrypoint.go /build/postfix-entrypoint.go
+COPY tests/smoke.go /build/smoke.go
+RUN go vet /build/postfix-entrypoint.go && go vet /build/smoke.go \
+    && CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' -o /usr/local/bin/postfix-entrypoint /build/postfix-entrypoint.go \
+    && CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' -o /build/smoke /build/smoke.go \
+    && newaliases
+COPY build/runtime-root.py /build/runtime-root.py
+RUN python3 /build/runtime-root.py /runtime /usr/local/bin/postfix-entrypoint \
+    /usr/libexec/postfix/master /usr/libexec/postfix/anvil /usr/libexec/postfix/bounce \
+    /usr/libexec/postfix/cleanup /usr/libexec/postfix/discard /usr/libexec/postfix/error \
+    /usr/libexec/postfix/flush /usr/libexec/postfix/local /usr/libexec/postfix/lmtp \
+    /usr/libexec/postfix/pickup /usr/libexec/postfix/proxymap /usr/libexec/postfix/qmgr \
+    /usr/libexec/postfix/scache /usr/libexec/postfix/showq /usr/libexec/postfix/smtp \
+    /usr/libexec/postfix/smtpd /usr/libexec/postfix/tlsmgr /usr/libexec/postfix/trivial-rewrite \
+    /usr/libexec/postfix/verify /usr/libexec/postfix/virtual /usr/libexec/postfix/postlogd \
+    /usr/sbin/postalias /usr/sbin/postcat /usr/sbin/postconf /usr/sbin/postdrop \
+    /usr/sbin/postkick /usr/sbin/postlock /usr/sbin/postlog /usr/sbin/postmap \
+    /usr/sbin/postqueue /usr/sbin/postsuper /usr/sbin/sendmail
 
-# Variables for Labels
-ARG VENDOR="k2patel"
-ARG COMPONENT="postfix-relay"
-ARG BUILD_DATE
-ARG GIT_REPO="https://git.k2patel.in/k2patel/docker-postfix"
-ARG VCS_REF
-ARG VERSION="2.0"
-ARG NAME="dockerized-${COMPONENT}"
-ARG DESCRIPTION="Postfix SMTP relay supporting multiple providers (Maileroo, Mailtrap, SendGrid)"
-ARG DOCUMENTATION="https://git.k2patel.in/k2patel/docker-postfix"
-ARG AUTHOR="k2patel"
-ARG LICENSE="MIT"
+# Test in the exact shell-free filesystem; publication depends on this stage.
+FROM scratch AS test
+COPY --from=build /runtime/ /
+ENV PATH=/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+RUN --mount=type=bind,from=build,source=/build/smoke,target=/ci-smoke ["/ci-smoke"]
 
-# Labels
-LABEL org.label-schema.build-date="${BUILD_DATE}" \
-    org.label-schema.name="${NAME}" \
-    org.label-schema.description="${DESCRIPTION}" \
-    org.label-schema.vcs-ref="${VCS_REF}" \
-    org.label-schema.vcs-url="${GIT_REPO}" \
-    org.label-schema.vendor="${VENDOR}" \
-    org.label-schema.version="${VERSION}"
-
-# Install required packages
-RUN apk add --no-cache \
-    postfix \
-    postfix-pcre \
-    cyrus-sasl \
-    cyrus-sasl-login \
-    libsasl \
-    ca-certificates \
-    bash \
-    tzdata \
-    mailx
-
-# Create necessary directories
-RUN mkdir -p /var/spool/postfix /etc/postfix/sasl
-
-# Copy entrypoint script
-COPY run.sh /run.sh
-RUN chmod +x /run.sh
-
-# Initialize postfix
-RUN newaliases
-
-# Expose SMTP port
+# Export the pristine runtime, excluding smoke-test credentials, queues and logs.
+FROM scratch
+COPY --from=build /runtime/ /
+COPY --from=test /tmp/smoke-passed /usr/share/postfix-build-check
+LABEL org.opencontainers.image.source="https://git.k2patel.in/k2patel/docker-postfix" \
+    org.opencontainers.image.description="Alpine/musl distroless Postfix SMTP relay" \
+    org.opencontainers.image.licenses="MIT"
+ENV PATH=/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 EXPOSE 25
-
-# Volumes for persistence
 VOLUME ["/var/spool/postfix"]
-
-# Health check
 HEALTHCHECK --interval=30s --timeout=10s --retries=3 --start-period=40s \
-    CMD postfix status || exit 1
-
-# Run postfix in foreground
-ENTRYPOINT ["/run.sh"]
+    CMD ["/usr/local/bin/postfix-entrypoint", "--healthcheck"]
+ENTRYPOINT ["/usr/local/bin/postfix-entrypoint"]