# Custom Grafana image embedding dashboards
# Base pinned by digest as well as tag: a tag is mutable, and the digest is what
# makes the trivy-*-grafana gates scan the image this build consumes.
FROM docker.io/grafana/grafana:13.1.4-ubuntu@sha256:896eef20331ff395b7389c6b3da5c728f68caf3f62323b5bfbb4e71b67d9cf34
USER root

# Copy dashboards as Grafana user (UID 472)
COPY --chown=472:472 dashboards/ /etc/grafana/dashboards/

# Back to the upstream runtime user: otherwise the pushed image config leaves
# USER at root (DS-0002), and not every consumer sets runAsUser at pod level.
USER 472
