Dockerfile

# The recovery kit.
#
# Consumes the binary GoReleaser already built; this is not a compile stage.
#
# It is built FROM postgres-barman, not from alpine, and that is the whole point.
# When you actually need this, the host you would normally ssh into may be the
# thing you are recovering FROM -- so the image carries everything a restore
# needs, pinned together and versioned as one artifact:
#
#   pgctl              the orchestration and the guards
#   barman-cloud-*     pulls the base backup and replays WAL from the bucket
#   postgres 18        boots the result
#   psql / pg_isready  proves it holds real data
#
# Nothing to install, no versions to reconcile at 3am, no "which barman was that
# cluster built with". One `docker run`, a bucket, and a set of credentials:
#
#   docker run --rm -it \
#     -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_DEFAULT_REGION=<region> \
#     -v "$PWD/pgctl.yaml:/pgctl.yaml:ro" \
#     -v "$PWD/recovered:/var/lib/postgresql" \
#     ghcr.io/metsaapp/pgctl:latest \
#     restore --local --config /pgctl.yaml --env <name> --to '2026-07-12 03:00:00'
#
# The base image is pinned by digest at release time (see .goreleaser.yaml), so a
# rebuild of postgres-barman cannot silently change what a released recovery
# image contains.
ARG BASE=ghcr.io/metsaapp/postgres-barman:18
FROM ${BASE}

# ssh, so the same image can also drive a live host (the scheduled drill) rather
# than only restoring locally. ca-certificates for the S3 endpoint.
USER root
RUN set -eux; \
	apt-get update; \
	apt-get install -y --no-install-recommends openssh-client ca-certificates; \
	rm -rf /var/lib/apt/lists/*

# GoReleaser has already built the binary for every platform and staged them by
# platform in the build context (linux/amd64/pgctl, ...), so there is nothing to
# compile here. TARGETPLATFORM is set by buildx for each arch it builds.
ARG TARGETPLATFORM
COPY ${TARGETPLATFORM}/pgctl /usr/local/bin/pgctl

# Inside this image there is no host to ssh to by default: everything pgctl needs
# is right here. --local is still accepted explicitly; this just makes the common
# case the default one.
ENV PGCTL_LOCAL=1

# Deliberately NOT the postgres entrypoint: this image is a tool, not a server.
# You restore with it, then start postgres against the result yourself.
ENTRYPOINT ["/usr/local/bin/pgctl"]
CMD ["version"]