From 8963caf263384023a1426d434af1500f2832c544 Mon Sep 17 00:00:00 2001
From: Hans Knecht <hans@anomalo.com>
Date: Tue, 10 Feb 2026 13:19:44 +0100
Subject: [PATCH 1/7] feat(github-action): build and publish container images

---
 .github/workflows/publish-images.yaml | 73 +++++++++++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 .github/workflows/publish-images.yaml

diff --git a/.github/workflows/publish-images.yaml b/.github/workflows/publish-images.yaml
new file mode 100644
index 000000000..a429b96b2
--- /dev/null
+++ b/.github/workflows/publish-images.yaml
@@ -0,0 +1,73 @@
+name: Publish Kraken Images
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - '*'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - component: kraken-agent
+            dockerfile: docker/agent/Dockerfile
+          - component: kraken-build-index
+            dockerfile: docker/build-index/Dockerfile
+          - component: kraken-origin
+            dockerfile: docker/origin/Dockerfile
+          - component: kraken-proxy
+            dockerfile: docker/proxy/Dockerfile
+          - component: kraken-testfs
+            dockerfile: docker/testfs/Dockerfile
+          - component: kraken-tracker
+            dockerfile: docker/tracker/Dockerfile
+          - component: kraken-herd
+            dockerfile: docker/herd/Dockerfile
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: amd64,arm64
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Generate image metadata (${{ matrix.component }})
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository_owner }}/${{ matrix.component }}
+          tags: |
+            type=ref,event=tag
+            type=ref,event=branch
+            type=sha,format=short
+
+      - name: Build and push ${{ matrix.component }}
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ${{ matrix.dockerfile }}
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

From c6c3c8667aa4a4cea212afcdf40f066c967e3373 Mon Sep 17 00:00:00 2001
From: Hans Knecht <hans@anomalo.com>
Date: Tue, 10 Feb 2026 13:34:10 +0100
Subject: [PATCH 2/7] feat: build binaries as part of dockerfiles

---
 docker/agent/Dockerfile       | 21 ++++++++++++++++++++-
 docker/build-index/Dockerfile | 21 ++++++++++++++++++++-
 docker/herd/Dockerfile        | 33 ++++++++++++++++++++++++++++-----
 docker/origin/Dockerfile      | 21 ++++++++++++++++++++-
 docker/proxy/Dockerfile       | 21 ++++++++++++++++++++-
 docker/testfs/Dockerfile      | 21 ++++++++++++++++++++-
 docker/tracker/Dockerfile     | 21 ++++++++++++++++++++-
 7 files changed, 148 insertions(+), 11 deletions(-)

diff --git a/docker/agent/Dockerfile b/docker/agent/Dockerfile
index dc3695125..d3a9475d4 100644
--- a/docker/agent/Dockerfile
+++ b/docker/agent/Dockerfile
@@ -1,3 +1,22 @@
+FROM golang:1.23.11 AS builder
+
+ARG TARGETOS=linux
+ARG TARGETARCH=amd64
+ENV CGO_ENABLED=1 GO111MODULE=on
+
+WORKDIR /src
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends build-essential pkg-config sqlite3 libsqlite3-dev && \
+    rm -rf /var/lib/apt/lists/*
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+RUN mkdir -p /out && \
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-agent ./agent
+
 FROM debian:12
 
 RUN echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/99no-check-valid-until && \
@@ -32,7 +51,7 @@ RUN if [ ${USERID} != "0" ]; then useradd --uid ${USERID} ${USERNAME}; fi
 COPY ./docker/setup_nginx.sh /tmp/setup_nginx.sh
 RUN /tmp/setup_nginx.sh ${USERNAME}
 
-COPY ./agent/agent /usr/bin/kraken-agent
+COPY --from=builder /out/kraken-agent /usr/bin/kraken-agent
 COPY ./config /etc/kraken/config
 COPY ./nginx/config /etc/kraken/nginx/config
 COPY ./test/tls /etc/kraken/tls
diff --git a/docker/build-index/Dockerfile b/docker/build-index/Dockerfile
index 463f3868f..7e277094e 100644
--- a/docker/build-index/Dockerfile
+++ b/docker/build-index/Dockerfile
@@ -1,3 +1,22 @@
+FROM golang:1.23.11 AS builder
+
+ARG TARGETOS=linux
+ARG TARGETARCH=amd64
+ENV CGO_ENABLED=1 GO111MODULE=on
+
+WORKDIR /src
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends build-essential pkg-config sqlite3 libsqlite3-dev && \
+    rm -rf /var/lib/apt/lists/*
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+RUN mkdir -p /out && \
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-build-index ./build-index
+
 FROM debian:12
 
 # Fix repository configuration for Debian 12 (bookworm) with multiple mirrors and better retry logic
@@ -33,7 +52,7 @@ RUN if [ ${USERID} != "0" ]; then useradd --uid ${USERID} ${USERNAME}; fi
 COPY ./docker/setup_nginx.sh /tmp/setup_nginx.sh
 RUN /tmp/setup_nginx.sh ${USERNAME}
 
-COPY ./build-index/build-index /usr/bin/kraken-build-index
+COPY --from=builder /out/kraken-build-index /usr/bin/kraken-build-index
 COPY ./config /etc/kraken/config
 COPY ./nginx/config /etc/kraken-build-index/nginx/config
 COPY ./localdb/migrations /etc/kraken-build-index/localdb/migrations
diff --git a/docker/herd/Dockerfile b/docker/herd/Dockerfile
index 3d5cc1db8..e5c0cb09b 100644
--- a/docker/herd/Dockerfile
+++ b/docker/herd/Dockerfile
@@ -1,5 +1,28 @@
 # This image combines all central components into one container, for easier
 # deployment and management.
+FROM golang:1.23.11 AS builder
+
+ARG TARGETOS=linux
+ARG TARGETARCH=amd64
+ENV CGO_ENABLED=1 GO111MODULE=on
+
+WORKDIR /src
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends build-essential pkg-config sqlite3 libsqlite3-dev && \
+    rm -rf /var/lib/apt/lists/*
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+RUN mkdir -p /out && \
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-build-index ./build-index && \
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-origin ./origin && \
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-proxy ./proxy && \
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-testfs ./tools/bin/testfs && \
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-tracker ./tracker
+
 FROM debian:12
 
 # Fix repository configuration for Debian 12 (bookworm) with multiple mirrors and better retry logic
@@ -58,11 +81,11 @@ RUN if [ ${USERID} != "0" ]; then mkdir -p /etc/sudoers.d/ && \
 COPY ./docker/setup_nginx.sh /tmp/setup_nginx.sh
 RUN /tmp/setup_nginx.sh ${USERNAME}
 
-COPY ./build-index/build-index /usr/bin/kraken-build-index
-COPY ./origin/origin           /usr/bin/kraken-origin
-COPY ./proxy/proxy             /usr/bin/kraken-proxy
-COPY ./tools/bin/testfs/testfs /usr/bin/kraken-testfs
-COPY ./tracker/tracker         /usr/bin/kraken-tracker
+COPY --from=builder /out/kraken-build-index /usr/bin/kraken-build-index
+COPY --from=builder /out/kraken-origin /usr/bin/kraken-origin
+COPY --from=builder /out/kraken-proxy /usr/bin/kraken-proxy
+COPY --from=builder /out/kraken-testfs /usr/bin/kraken-testfs
+COPY --from=builder /out/kraken-tracker /usr/bin/kraken-tracker
 
 RUN chmod +x /usr/bin/kraken-build-index && \
     chmod +x /usr/bin/kraken-origin && \
diff --git a/docker/origin/Dockerfile b/docker/origin/Dockerfile
index cdc65af3f..67df82de6 100644
--- a/docker/origin/Dockerfile
+++ b/docker/origin/Dockerfile
@@ -1,3 +1,22 @@
+FROM golang:1.23.11 AS builder
+
+ARG TARGETOS=linux
+ARG TARGETARCH=amd64
+ENV CGO_ENABLED=1 GO111MODULE=on
+
+WORKDIR /src
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends build-essential pkg-config sqlite3 libsqlite3-dev && \
+    rm -rf /var/lib/apt/lists/*
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+RUN mkdir -p /out && \
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-origin ./origin
+
 FROM debian:12
 
 # Fix repository configuration for Debian 12 (bookworm) with multiple mirrors and better retry logic
@@ -34,7 +53,7 @@ RUN if [ ${USERID} != "0" ]; then useradd --uid ${USERID} ${USERNAME}; fi
 COPY ./docker/setup_nginx.sh /tmp/setup_nginx.sh
 RUN /tmp/setup_nginx.sh ${USERNAME}
 
-COPY ./origin/origin /usr/bin/kraken-origin
+COPY --from=builder /out/kraken-origin /usr/bin/kraken-origin
 COPY ./config /etc/kraken/config
 COPY ./nginx/config /etc/kraken/nginx/config
 COPY ./localdb/migrations /etc/kraken/localdb/migrations
diff --git a/docker/proxy/Dockerfile b/docker/proxy/Dockerfile
index 7e9048580..585d2bbad 100644
--- a/docker/proxy/Dockerfile
+++ b/docker/proxy/Dockerfile
@@ -1,3 +1,22 @@
+FROM golang:1.23.11 AS builder
+
+ARG TARGETOS=linux
+ARG TARGETARCH=amd64
+ENV CGO_ENABLED=1 GO111MODULE=on
+
+WORKDIR /src
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends build-essential pkg-config sqlite3 libsqlite3-dev && \
+    rm -rf /var/lib/apt/lists/*
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+RUN mkdir -p /out && \
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-proxy ./proxy
+
 FROM debian:12
 
 # Fix repository configuration for Debian 12 (bookworm) with multiple mirrors and better retry logic
@@ -33,7 +52,7 @@ RUN if [ ${USERID} != "0" ]; then useradd --uid ${USERID} ${USERNAME}; fi
 COPY ./docker/setup_nginx.sh /tmp/setup_nginx.sh
 RUN /tmp/setup_nginx.sh ${USERNAME}
 
-COPY ./proxy/proxy /usr/bin/kraken-proxy
+COPY --from=builder /out/kraken-proxy /usr/bin/kraken-proxy
 COPY ./config /etc/kraken/config
 COPY ./nginx/config /etc/kraken/nginx/config
 COPY ./test/tls /etc/kraken/tls
diff --git a/docker/testfs/Dockerfile b/docker/testfs/Dockerfile
index ef0230d06..6c499c222 100644
--- a/docker/testfs/Dockerfile
+++ b/docker/testfs/Dockerfile
@@ -1,3 +1,22 @@
+FROM golang:1.23.11 AS builder
+
+ARG TARGETOS=linux
+ARG TARGETARCH=amd64
+ENV CGO_ENABLED=1 GO111MODULE=on
+
+WORKDIR /src
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends build-essential pkg-config sqlite3 libsqlite3-dev && \
+    rm -rf /var/lib/apt/lists/*
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+RUN mkdir -p /out && \
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-testfs ./tools/bin/testfs
+
 FROM debian:12
 
 # Fix repository configuration for Debian 12 (bookworm) with CDN mirror for better stability
@@ -28,7 +47,7 @@ ARG USERNAME="root"
 ARG USERID="0"
 RUN if [ ${USERID} != "0" ]; then useradd --uid ${USERID} ${USERNAME}; fi
 
-COPY tools/bin/testfs/testfs /usr/bin/kraken-testfs
+COPY --from=builder /out/kraken-testfs /usr/bin/kraken-testfs
 RUN chmod +x /usr/bin/kraken-testfs
 
 USER ${USERNAME}
diff --git a/docker/tracker/Dockerfile b/docker/tracker/Dockerfile
index 212ef648d..55829f4db 100644
--- a/docker/tracker/Dockerfile
+++ b/docker/tracker/Dockerfile
@@ -1,3 +1,22 @@
+FROM golang:1.23.11 AS builder
+
+ARG TARGETOS=linux
+ARG TARGETARCH=amd64
+ENV CGO_ENABLED=1 GO111MODULE=on
+
+WORKDIR /src
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends build-essential pkg-config sqlite3 libsqlite3-dev && \
+    rm -rf /var/lib/apt/lists/*
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+RUN mkdir -p /out && \
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-tracker ./tracker
+
 FROM debian:12
 
 # Fix repository configuration for Debian 12 (bookworm) with multiple mirrors and better retry logic
@@ -33,7 +52,7 @@ RUN if [ ${USERID} != "0" ]; then useradd --uid ${USERID} ${USERNAME}; fi
 COPY ./docker/setup_nginx.sh /tmp/setup_nginx.sh
 RUN /tmp/setup_nginx.sh ${USERNAME}
 
-COPY ./tracker/tracker /usr/bin/kraken-tracker
+COPY --from=builder /out/kraken-tracker /usr/bin/kraken-tracker
 COPY ./config /etc/kraken/config
 COPY ./nginx/config /etc/kraken/nginx/config
 COPY ./test/tls /etc/kraken/tls

From 3f5a7dfb3a6e66ff2d0dbbba80e05528c9d40419 Mon Sep 17 00:00:00 2001
From: Hans Knecht <hans@anomalo.com>
Date: Tue, 10 Feb 2026 13:35:44 +0100
Subject: [PATCH 3/7] fix: correct branhc

---
 .github/workflows/publish-images.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish-images.yaml b/.github/workflows/publish-images.yaml
index a429b96b2..62ee44691 100644
--- a/.github/workflows/publish-images.yaml
+++ b/.github/workflows/publish-images.yaml
@@ -3,7 +3,7 @@ name: Publish Kraken Images
 on:
   push:
     branches:
-      - main
+      - master
     tags:
       - '*'
   workflow_dispatch:

From da7a4dac998cfd592574476243bb120515a70ade Mon Sep 17 00:00:00 2001
From: Hans Knecht <hans@anomalo.com>
Date: Tue, 10 Feb 2026 13:43:37 +0100
Subject: [PATCH 4/7] fix: use platform directly for compilation

---
 docker/agent/Dockerfile       | 14 +++++++++++---
 docker/build-index/Dockerfile | 14 +++++++++++---
 docker/herd/Dockerfile        | 22 +++++++++++++++-------
 docker/origin/Dockerfile      | 14 +++++++++++---
 docker/proxy/Dockerfile       | 14 +++++++++++---
 docker/testfs/Dockerfile      | 14 +++++++++++---
 docker/tracker/Dockerfile     | 14 +++++++++++---
 7 files changed, 81 insertions(+), 25 deletions(-)

diff --git a/docker/agent/Dockerfile b/docker/agent/Dockerfile
index d3a9475d4..713056524 100644
--- a/docker/agent/Dockerfile
+++ b/docker/agent/Dockerfile
@@ -1,4 +1,10 @@
-FROM golang:1.23.11 AS builder
+# syntax=docker/dockerfile:1.6
+
+ARG TARGETPLATFORM
+FROM --platform=$TARGETPLATFORM golang:1.23.11 AS builder
+
+ARG TARGETOS=linux
+ARG TARGETARCH
 
 ARG TARGETOS=linux
 ARG TARGETARCH=amd64
@@ -14,8 +20,10 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN mkdir -p /out && \
-    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-agent ./agent
+RUN set -euo pipefail; \
+    ARCH=${TARGETARCH:-$(dpkg --print-architecture)}; \
+    mkdir -p /out && \
+    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-agent ./agent
 
 FROM debian:12
 
diff --git a/docker/build-index/Dockerfile b/docker/build-index/Dockerfile
index 7e277094e..1788ad0d4 100644
--- a/docker/build-index/Dockerfile
+++ b/docker/build-index/Dockerfile
@@ -1,4 +1,10 @@
-FROM golang:1.23.11 AS builder
+# syntax=docker/dockerfile:1.6
+
+ARG TARGETPLATFORM
+FROM --platform=$TARGETPLATFORM golang:1.23.11 AS builder
+
+ARG TARGETOS=linux
+ARG TARGETARCH
 
 ARG TARGETOS=linux
 ARG TARGETARCH=amd64
@@ -14,8 +20,10 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN mkdir -p /out && \
-    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-build-index ./build-index
+RUN set -euo pipefail; \
+    ARCH=${TARGETARCH:-$(dpkg --print-architecture)}; \
+    mkdir -p /out && \
+    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-build-index ./build-index
 
 FROM debian:12
 
diff --git a/docker/herd/Dockerfile b/docker/herd/Dockerfile
index e5c0cb09b..f9ac9350b 100644
--- a/docker/herd/Dockerfile
+++ b/docker/herd/Dockerfile
@@ -1,6 +1,12 @@
+# syntax=docker/dockerfile:1.6
+
 # This image combines all central components into one container, for easier
 # deployment and management.
-FROM golang:1.23.11 AS builder
+ARG TARGETPLATFORM
+FROM --platform=$TARGETPLATFORM golang:1.23.11 AS builder
+
+ARG TARGETOS=linux
+ARG TARGETARCH
 
 ARG TARGETOS=linux
 ARG TARGETARCH=amd64
@@ -16,12 +22,14 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN mkdir -p /out && \
-    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-build-index ./build-index && \
-    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-origin ./origin && \
-    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-proxy ./proxy && \
-    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-testfs ./tools/bin/testfs && \
-    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-tracker ./tracker
+RUN set -euo pipefail; \
+    ARCH=${TARGETARCH:-$(dpkg --print-architecture)}; \
+    mkdir -p /out && \
+    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-build-index ./build-index && \
+    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-origin ./origin && \
+    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-proxy ./proxy && \
+    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-testfs ./tools/bin/testfs && \
+    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-tracker ./tracker
 
 FROM debian:12
 
diff --git a/docker/origin/Dockerfile b/docker/origin/Dockerfile
index 67df82de6..e68f8e3e7 100644
--- a/docker/origin/Dockerfile
+++ b/docker/origin/Dockerfile
@@ -1,4 +1,10 @@
-FROM golang:1.23.11 AS builder
+# syntax=docker/dockerfile:1.6
+
+ARG TARGETPLATFORM
+FROM --platform=$TARGETPLATFORM golang:1.23.11 AS builder
+
+ARG TARGETOS=linux
+ARG TARGETARCH
 
 ARG TARGETOS=linux
 ARG TARGETARCH=amd64
@@ -14,8 +20,10 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN mkdir -p /out && \
-    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-origin ./origin
+RUN set -euo pipefail; \
+    ARCH=${TARGETARCH:-$(dpkg --print-architecture)}; \
+    mkdir -p /out && \
+    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-origin ./origin
 
 FROM debian:12
 
diff --git a/docker/proxy/Dockerfile b/docker/proxy/Dockerfile
index 585d2bbad..f144cffd6 100644
--- a/docker/proxy/Dockerfile
+++ b/docker/proxy/Dockerfile
@@ -1,4 +1,10 @@
-FROM golang:1.23.11 AS builder
+# syntax=docker/dockerfile:1.6
+
+ARG TARGETPLATFORM
+FROM --platform=$TARGETPLATFORM golang:1.23.11 AS builder
+
+ARG TARGETOS=linux
+ARG TARGETARCH
 
 ARG TARGETOS=linux
 ARG TARGETARCH=amd64
@@ -14,8 +20,10 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN mkdir -p /out && \
-    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-proxy ./proxy
+RUN set -euo pipefail; \
+    ARCH=${TARGETARCH:-$(dpkg --print-architecture)}; \
+    mkdir -p /out && \
+    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-proxy ./proxy
 
 FROM debian:12
 
diff --git a/docker/testfs/Dockerfile b/docker/testfs/Dockerfile
index 6c499c222..877f35708 100644
--- a/docker/testfs/Dockerfile
+++ b/docker/testfs/Dockerfile
@@ -1,4 +1,10 @@
-FROM golang:1.23.11 AS builder
+# syntax=docker/dockerfile:1.6
+
+ARG TARGETPLATFORM
+FROM --platform=$TARGETPLATFORM golang:1.23.11 AS builder
+
+ARG TARGETOS=linux
+ARG TARGETARCH
 
 ARG TARGETOS=linux
 ARG TARGETARCH=amd64
@@ -14,8 +20,10 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN mkdir -p /out && \
-    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-testfs ./tools/bin/testfs
+RUN set -euo pipefail; \
+    ARCH=${TARGETARCH:-$(dpkg --print-architecture)}; \
+    mkdir -p /out && \
+    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-testfs ./tools/bin/testfs
 
 FROM debian:12
 
diff --git a/docker/tracker/Dockerfile b/docker/tracker/Dockerfile
index 55829f4db..e21e0b11d 100644
--- a/docker/tracker/Dockerfile
+++ b/docker/tracker/Dockerfile
@@ -1,4 +1,10 @@
-FROM golang:1.23.11 AS builder
+# syntax=docker/dockerfile:1.6
+
+ARG TARGETPLATFORM
+FROM --platform=$TARGETPLATFORM golang:1.23.11 AS builder
+
+ARG TARGETOS=linux
+ARG TARGETARCH
 
 ARG TARGETOS=linux
 ARG TARGETARCH=amd64
@@ -14,8 +20,10 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN mkdir -p /out && \
-    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -buildvcs=false -o /out/kraken-tracker ./tracker
+RUN set -euo pipefail; \
+    ARCH=${TARGETARCH:-$(dpkg --print-architecture)}; \
+    mkdir -p /out && \
+    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-tracker ./tracker
 
 FROM debian:12
 

From edc1a8fd4c9e73605a10f735079953f8af481d91 Mon Sep 17 00:00:00 2001
From: Hans Knecht <hans@anomalo.com>
Date: Tue, 10 Feb 2026 14:00:18 +0100
Subject: [PATCH 5/7] fix: simplify images

---
 docker/agent/Dockerfile       | 14 ++++----------
 docker/build-index/Dockerfile | 14 ++++----------
 docker/herd/Dockerfile        | 22 ++++++++--------------
 docker/origin/Dockerfile      | 14 ++++----------
 docker/proxy/Dockerfile       | 14 ++++----------
 docker/testfs/Dockerfile      | 14 ++++----------
 docker/tracker/Dockerfile     | 14 ++++----------
 7 files changed, 32 insertions(+), 74 deletions(-)

diff --git a/docker/agent/Dockerfile b/docker/agent/Dockerfile
index 713056524..9d1b582fe 100644
--- a/docker/agent/Dockerfile
+++ b/docker/agent/Dockerfile
@@ -1,13 +1,9 @@
 # syntax=docker/dockerfile:1.6
 
-ARG TARGETPLATFORM
-FROM --platform=$TARGETPLATFORM golang:1.23.11 AS builder
+FROM golang:1.23.11 AS builder
 
-ARG TARGETOS=linux
+ARG TARGETOS
 ARG TARGETARCH
-
-ARG TARGETOS=linux
-ARG TARGETARCH=amd64
 ENV CGO_ENABLED=1 GO111MODULE=on
 
 WORKDIR /src
@@ -20,10 +16,8 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN set -euo pipefail; \
-    ARCH=${TARGETARCH:-$(dpkg --print-architecture)}; \
-    mkdir -p /out && \
-    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-agent ./agent
+RUN mkdir -p /out && \
+    go build -buildvcs=false -o /out/kraken-agent ./agent
 
 FROM debian:12
 
diff --git a/docker/build-index/Dockerfile b/docker/build-index/Dockerfile
index 1788ad0d4..5d510563c 100644
--- a/docker/build-index/Dockerfile
+++ b/docker/build-index/Dockerfile
@@ -1,13 +1,9 @@
 # syntax=docker/dockerfile:1.6
 
-ARG TARGETPLATFORM
-FROM --platform=$TARGETPLATFORM golang:1.23.11 AS builder
+FROM golang:1.23.11 AS builder
 
-ARG TARGETOS=linux
+ARG TARGETOS
 ARG TARGETARCH
-
-ARG TARGETOS=linux
-ARG TARGETARCH=amd64
 ENV CGO_ENABLED=1 GO111MODULE=on
 
 WORKDIR /src
@@ -20,10 +16,8 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN set -euo pipefail; \
-    ARCH=${TARGETARCH:-$(dpkg --print-architecture)}; \
-    mkdir -p /out && \
-    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-build-index ./build-index
+RUN mkdir -p /out && \
+    go build -buildvcs=false -o /out/kraken-build-index ./build-index
 
 FROM debian:12
 
diff --git a/docker/herd/Dockerfile b/docker/herd/Dockerfile
index f9ac9350b..ec1ce2a34 100644
--- a/docker/herd/Dockerfile
+++ b/docker/herd/Dockerfile
@@ -2,14 +2,10 @@
 
 # This image combines all central components into one container, for easier
 # deployment and management.
-ARG TARGETPLATFORM
-FROM --platform=$TARGETPLATFORM golang:1.23.11 AS builder
+FROM golang:1.23.11 AS builder
 
-ARG TARGETOS=linux
+ARG TARGETOS
 ARG TARGETARCH
-
-ARG TARGETOS=linux
-ARG TARGETARCH=amd64
 ENV CGO_ENABLED=1 GO111MODULE=on
 
 WORKDIR /src
@@ -22,14 +18,12 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN set -euo pipefail; \
-    ARCH=${TARGETARCH:-$(dpkg --print-architecture)}; \
-    mkdir -p /out && \
-    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-build-index ./build-index && \
-    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-origin ./origin && \
-    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-proxy ./proxy && \
-    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-testfs ./tools/bin/testfs && \
-    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-tracker ./tracker
+RUN mkdir -p /out && \
+    go build -buildvcs=false -o /out/kraken-build-index ./build-index && \
+    go build -buildvcs=false -o /out/kraken-origin ./origin && \
+    go build -buildvcs=false -o /out/kraken-proxy ./proxy && \
+    go build -buildvcs=false -o /out/kraken-testfs ./tools/bin/testfs && \
+    go build -buildvcs=false -o /out/kraken-tracker ./tracker
 
 FROM debian:12
 
diff --git a/docker/origin/Dockerfile b/docker/origin/Dockerfile
index e68f8e3e7..0467f2b51 100644
--- a/docker/origin/Dockerfile
+++ b/docker/origin/Dockerfile
@@ -1,13 +1,9 @@
 # syntax=docker/dockerfile:1.6
 
-ARG TARGETPLATFORM
-FROM --platform=$TARGETPLATFORM golang:1.23.11 AS builder
+FROM golang:1.23.11 AS builder
 
-ARG TARGETOS=linux
+ARG TARGETOS
 ARG TARGETARCH
-
-ARG TARGETOS=linux
-ARG TARGETARCH=amd64
 ENV CGO_ENABLED=1 GO111MODULE=on
 
 WORKDIR /src
@@ -20,10 +16,8 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN set -euo pipefail; \
-    ARCH=${TARGETARCH:-$(dpkg --print-architecture)}; \
-    mkdir -p /out && \
-    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-origin ./origin
+RUN mkdir -p /out && \
+    go build -buildvcs=false -o /out/kraken-origin ./origin
 
 FROM debian:12
 
diff --git a/docker/proxy/Dockerfile b/docker/proxy/Dockerfile
index f144cffd6..2917e1397 100644
--- a/docker/proxy/Dockerfile
+++ b/docker/proxy/Dockerfile
@@ -1,13 +1,9 @@
 # syntax=docker/dockerfile:1.6
 
-ARG TARGETPLATFORM
-FROM --platform=$TARGETPLATFORM golang:1.23.11 AS builder
+FROM golang:1.23.11 AS builder
 
-ARG TARGETOS=linux
+ARG TARGETOS
 ARG TARGETARCH
-
-ARG TARGETOS=linux
-ARG TARGETARCH=amd64
 ENV CGO_ENABLED=1 GO111MODULE=on
 
 WORKDIR /src
@@ -20,10 +16,8 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN set -euo pipefail; \
-    ARCH=${TARGETARCH:-$(dpkg --print-architecture)}; \
-    mkdir -p /out && \
-    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-proxy ./proxy
+RUN mkdir -p /out && \
+    go build -buildvcs=false -o /out/kraken-proxy ./proxy
 
 FROM debian:12
 
diff --git a/docker/testfs/Dockerfile b/docker/testfs/Dockerfile
index 877f35708..8c0dd2e4b 100644
--- a/docker/testfs/Dockerfile
+++ b/docker/testfs/Dockerfile
@@ -1,13 +1,9 @@
 # syntax=docker/dockerfile:1.6
 
-ARG TARGETPLATFORM
-FROM --platform=$TARGETPLATFORM golang:1.23.11 AS builder
+FROM golang:1.23.11 AS builder
 
-ARG TARGETOS=linux
+ARG TARGETOS
 ARG TARGETARCH
-
-ARG TARGETOS=linux
-ARG TARGETARCH=amd64
 ENV CGO_ENABLED=1 GO111MODULE=on
 
 WORKDIR /src
@@ -20,10 +16,8 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN set -euo pipefail; \
-    ARCH=${TARGETARCH:-$(dpkg --print-architecture)}; \
-    mkdir -p /out && \
-    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-testfs ./tools/bin/testfs
+RUN mkdir -p /out && \
+    go build -buildvcs=false -o /out/kraken-testfs ./tools/bin/testfs
 
 FROM debian:12
 
diff --git a/docker/tracker/Dockerfile b/docker/tracker/Dockerfile
index e21e0b11d..f082e703a 100644
--- a/docker/tracker/Dockerfile
+++ b/docker/tracker/Dockerfile
@@ -1,13 +1,9 @@
 # syntax=docker/dockerfile:1.6
 
-ARG TARGETPLATFORM
-FROM --platform=$TARGETPLATFORM golang:1.23.11 AS builder
+FROM golang:1.23.11 AS builder
 
-ARG TARGETOS=linux
+ARG TARGETOS
 ARG TARGETARCH
-
-ARG TARGETOS=linux
-ARG TARGETARCH=amd64
 ENV CGO_ENABLED=1 GO111MODULE=on
 
 WORKDIR /src
@@ -20,10 +16,8 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN set -euo pipefail; \
-    ARCH=${TARGETARCH:-$(dpkg --print-architecture)}; \
-    mkdir -p /out && \
-    GOOS=${TARGETOS} GOARCH=${ARCH} go build -buildvcs=false -o /out/kraken-tracker ./tracker
+RUN mkdir -p /out && \
+    go build -buildvcs=false -o /out/kraken-tracker ./tracker
 
 FROM debian:12
 

From ae1772454232fd595bb0f3b8ff2176e341b65dc1 Mon Sep 17 00:00:00 2001
From: Hans Knecht <hans@anomalo.com>
Date: Tue, 10 Feb 2026 14:29:47 +0100
Subject: [PATCH 6/7] chore: remove unneded args

---
 docker/agent/Dockerfile       | 3 +--
 docker/build-index/Dockerfile | 3 +--
 docker/herd/Dockerfile        | 3 +--
 docker/origin/Dockerfile      | 3 +--
 docker/proxy/Dockerfile       | 3 +--
 docker/testfs/Dockerfile      | 3 +--
 docker/tracker/Dockerfile     | 3 +--
 7 files changed, 7 insertions(+), 14 deletions(-)

diff --git a/docker/agent/Dockerfile b/docker/agent/Dockerfile
index 9d1b582fe..e692166dc 100644
--- a/docker/agent/Dockerfile
+++ b/docker/agent/Dockerfile
@@ -2,8 +2,7 @@
 
 FROM golang:1.23.11 AS builder
 
-ARG TARGETOS
-ARG TARGETARCH
+
 ENV CGO_ENABLED=1 GO111MODULE=on
 
 WORKDIR /src
diff --git a/docker/build-index/Dockerfile b/docker/build-index/Dockerfile
index 5d510563c..e59d6b4fc 100644
--- a/docker/build-index/Dockerfile
+++ b/docker/build-index/Dockerfile
@@ -2,8 +2,7 @@
 
 FROM golang:1.23.11 AS builder
 
-ARG TARGETOS
-ARG TARGETARCH
+
 ENV CGO_ENABLED=1 GO111MODULE=on
 
 WORKDIR /src
diff --git a/docker/herd/Dockerfile b/docker/herd/Dockerfile
index ec1ce2a34..1cad664e7 100644
--- a/docker/herd/Dockerfile
+++ b/docker/herd/Dockerfile
@@ -4,8 +4,7 @@
 # deployment and management.
 FROM golang:1.23.11 AS builder
 
-ARG TARGETOS
-ARG TARGETARCH
+
 ENV CGO_ENABLED=1 GO111MODULE=on
 
 WORKDIR /src
diff --git a/docker/origin/Dockerfile b/docker/origin/Dockerfile
index 0467f2b51..4b4d0bf14 100644
--- a/docker/origin/Dockerfile
+++ b/docker/origin/Dockerfile
@@ -2,8 +2,7 @@
 
 FROM golang:1.23.11 AS builder
 
-ARG TARGETOS
-ARG TARGETARCH
+
 ENV CGO_ENABLED=1 GO111MODULE=on
 
 WORKDIR /src
diff --git a/docker/proxy/Dockerfile b/docker/proxy/Dockerfile
index 2917e1397..e92bfc97f 100644
--- a/docker/proxy/Dockerfile
+++ b/docker/proxy/Dockerfile
@@ -2,8 +2,7 @@
 
 FROM golang:1.23.11 AS builder
 
-ARG TARGETOS
-ARG TARGETARCH
+
 ENV CGO_ENABLED=1 GO111MODULE=on
 
 WORKDIR /src
diff --git a/docker/testfs/Dockerfile b/docker/testfs/Dockerfile
index 8c0dd2e4b..4a30e846c 100644
--- a/docker/testfs/Dockerfile
+++ b/docker/testfs/Dockerfile
@@ -2,8 +2,7 @@
 
 FROM golang:1.23.11 AS builder
 
-ARG TARGETOS
-ARG TARGETARCH
+
 ENV CGO_ENABLED=1 GO111MODULE=on
 
 WORKDIR /src
diff --git a/docker/tracker/Dockerfile b/docker/tracker/Dockerfile
index f082e703a..f4ea9e04d 100644
--- a/docker/tracker/Dockerfile
+++ b/docker/tracker/Dockerfile
@@ -2,8 +2,7 @@
 
 FROM golang:1.23.11 AS builder
 
-ARG TARGETOS
-ARG TARGETARCH
+
 ENV CGO_ENABLED=1 GO111MODULE=on
 
 WORKDIR /src

From ca0e9609d602e2e29b7a73780003b2c2f544730f Mon Sep 17 00:00:00 2001
From: Hans Knecht <hans@anomalo.com>
Date: Wed, 11 Feb 2026 16:53:33 +0100
Subject: [PATCH 7/7] fix: only push on tags

---
 .github/workflows/publish-images.yaml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.github/workflows/publish-images.yaml b/.github/workflows/publish-images.yaml
index 62ee44691..ffee8caa9 100644
--- a/.github/workflows/publish-images.yaml
+++ b/.github/workflows/publish-images.yaml
@@ -2,11 +2,8 @@ name: Publish Kraken Images
 
 on:
   push:
-    branches:
-      - master
     tags:
       - '*'
-  workflow_dispatch:
 
 permissions:
   contents: read