raw draft of policy-manager

Dockerfile

@@ -0,0 +1,31 @@
+# ---- Build Stage ----
+FROM golang:latest AS builder
+
+WORKDIR /app
+
+# Copy go mod files first (better caching)
+COPY go.mod ./
+RUN go mod download
+
+# Copy source code
+COPY . .
+
+# Build static binary
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o server
+
+# ---- Runtime Stage ----
+FROM gcr.io/distroless/base-debian12
+
+WORKDIR /app
+
+# Copy only the binary from builder
+COPY --from=builder /app/server .
+
+# Expose port
+EXPOSE 8080
+
+# Run as non-root user
+USER nonroot:nonroot
+
+ENTRYPOINT ["/app/server"]
+