chore: build improvements

Containerfile

@@ -1,7 +1,9 @@
+# syntax=docker/dockerfile:1
 ARG GOARCH=amd64
 ARG GOOS=linux
 ARG CGO_ENABLED=0
 ARG BUILD_TIME=unknown
+ARG VERSION=unknown
 ARG SERVICE
 
 # Stage 1: Build
@@ -10,8 +12,8 @@ FROM docker.io/golang:1.24-alpine AS build
 ARG GOOS
 ARG GOARCH
 ARG CGO_ENABLED
-ARG VERSION
 ARG BUILD_TIME
+ARG VERSION
 ARG SERVICE
 
 WORKDIR /src
@@ -29,34 +31,29 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
     GOOS=${GOOS} \
     GOARCH=${GOARCH} \
     go build -trimpath \
-    -ldflags="-s -w -X 'main.BuildTime=${BUILD_TIME}'" \
-    -o /bin/${SERVICE} ./cmd/${SERVICE}
+      -ldflags "-s -w -X main.BuildTime=${BUILD_TIME} -X main.Version=${VERSION}" \
+      -o /out/${SERVICE} ./cmd/${SERVICE} && \
+    chmod +x /out/${SERVICE}
 
 # Stage 2: Runtime
-FROM docker.io/alpine:3.22 AS runtime
+FROM gcr.io/distroless/static-debian13:latest AS runtime
 
-ARG VERSION
 ARG BUILD_TIME
+ARG VERSION
 ARG SERVICE
 
-RUN addgroup -S app && adduser -S -G app app
-
 WORKDIR /app
 
-COPY --from=build /bin/${SERVICE} /app/bin
-
-RUN chown app:app /app/bin && chmod +x /app/bin
-
-USER app
+COPY --from=build --chown=1000:1000 /out/${SERVICE} /app/bin/${SERVICE}
 
 EXPOSE 8080 50051
 
-HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
-    CMD wget -qO- --timeout=2 http://127.0.0.1:8080/health || exit 1
+LABEL org.opencontainers.image.created="${BUILD_TIME}" \
+      org.opencontainers.image.version="${VERSION}" \
+      org.opencontainers.image.title="${SERVICE}"
 
-LABEL org.opencontainers.image.version=${VERSION}
-LABEL org.opencontainers.image.created=${BUILD_TIME}
+USER 1000
 
-ENTRYPOINT ["/app/bin"]
+ENTRYPOINT ["/app/bin/${SERVICE}"]
 
-CMD [""]
+CMD []