Dockerfile

FROM docker.io/debian:bookworm-slim AS builder

USER root

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        curl ca-certificates jq tar \
    && rm -rf /var/lib/apt/lists/*

# Buildx sets these automatically, but declare them for clarity
ARG TARGETARCH

RUN set -eux; \
    cd /tmp; \
    latest="$(curl -s https://api.github.com/repos/oauth2-proxy/oauth2-proxy/releases/latest | jq -r '.tag_name' | sed 's/^v//')"; \
    curl -fsSL -o oauth2-proxy.tar.gz \
      "https://github.com/oauth2-proxy/oauth2-proxy/releases/download/v${latest}/oauth2-proxy-v${latest}.linux-${TARGETARCH}.tar.gz"; \
    tar -xzf oauth2-proxy.tar.gz; \
    cp "oauth2-proxy-v${latest}.linux-${TARGETARCH}/oauth2-proxy" /usr/local/bin/oauth2-proxy; \
    chmod 0755 /usr/local/bin/oauth2-proxy

FROM gcr.io/distroless/cc-debian12

COPY --from=builder /usr/local/bin/oauth2-proxy /usr/local/bin/oauth2-proxy

USER 1000:1000

CMD ["/usr/local/bin/oauth2-proxy"]