- Multi-stage build using golang:1.25-bookworm and debian:bookworm-slim
- CGO_ENABLED=0 for static binary compilation
- Cross-platform support via TARGETOS/TARGETARCH
- Non-root user (appuser) for security
- Data volume mount at /data
- Port 32768 exposed
- .dockerignore excludes build artifacts and planning docs
