From 9dbf00d67002159a75775baa662ee665a929edb3 Mon Sep 17 00:00:00 2001
From: Jan Michael Auer <mail@jauer.org>
Date: Thu, 12 Mar 2026 11:20:48 +0100
Subject: [PATCH] build(docker): Add debug image support via IMAGE_TAG arg

Parameterize the distroless base image tag in the Dockerfile so
build-cross.sh can switch to the debug-nonroot variant. Set
DEBUG_IMAGE=1 to get a shell-enabled image for debugging.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 Dockerfile             | 3 ++-
 scripts/build-cross.sh | 8 ++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index b732f059..b7fa22d8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,5 @@
-FROM gcr.io/distroless/cc-debian12:nonroot
+ARG IMAGE_TAG=nonroot
+FROM gcr.io/distroless/cc-debian12:${IMAGE_TAG}
 
 ARG BINARY=objectstore
 COPY ${BINARY} /bin/entrypoint
diff --git a/scripts/build-cross.sh b/scripts/build-cross.sh
index fa97367b..ee56d977 100755
--- a/scripts/build-cross.sh
+++ b/scripts/build-cross.sh
@@ -4,11 +4,18 @@ set -euo pipefail
 cd "$(dirname "$0")/.."
 
 BINARY=${1:-objectstore}
+DEBUG_IMAGE=${DEBUG_IMAGE:-false}
 case "$BINARY" in
     objectstore) PACKAGE="objectstore-server" ;;
     *) PACKAGE="$BINARY" ;;
 esac
 
+if [[ "$DEBUG_IMAGE" =~ ^(true|1|yes|on)$ ]]; then
+    IMAGE_TAG="debug-nonroot"
+else
+    IMAGE_TAG="nonroot"
+fi
+
 docker build \
     --platform linux/arm64 \
     -f Dockerfile.cross \
@@ -26,6 +33,7 @@ docker run --rm \
 docker build \
     --platform linux/amd64 \
     -f Dockerfile \
+    --build-arg IMAGE_TAG="$IMAGE_TAG" \
     --build-arg BINARY="$BINARY" \
     -t "$BINARY:latest" \
     "target/x86_64-unknown-linux-gnu/release/"