Initial push

Dockerfile

@@ -0,0 +1,39 @@
+# Build the web UI first; vite writes straight into the Go package that
+# embeds it, so the Go stage picks it up without extra wiring.
+FROM node:22-alpine AS ui
+WORKDIR /src/web
+COPY web/package.json web/package-lock.json ./
+RUN npm ci --no-audit --no-fund
+COPY web/ ./
+RUN npm run build
+
+FROM golang:1.26-alpine AS build
+ARG VERSION=dev
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+COPY --from=ui /src/internal/webui/dist ./internal/webui/dist
+# A static binary keeps the runtime image free of a libc and lets the same
+# artifact be copied onto a bare-metal host.
+RUN CGO_ENABLED=0 go build -trimpath \
+      -ldflags "-s -w -X main.version=${VERSION}" \
+      -o /out/docker-migrate .
+
+FROM alpine:3.22
+RUN apk add --no-cache ca-certificates tzdata && \
+    adduser -D -u 10001 migrate
+COPY --from=build /out/docker-migrate /usr/local/bin/docker-migrate
+
+# The container talks to the Docker socket mounted from the host, which is
+# owned by root:docker. It therefore runs as root by default; set --user to
+# override when the socket permissions on your host allow it.
+ENV DOCKER_MIGRATE_DATA=/data
+VOLUME ["/data"]
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s \
+  CMD wget -qO- http://127.0.0.1:8080/api/health >/dev/null || exit 1
+
+ENTRYPOINT ["docker-migrate"]
+CMD ["serve", "--addr", "0.0.0.0:8080"]