docker: multi-arch image via buildx BUILDPLATFORM/TARGETARCH

Rework the Dockerfile to produce a proper multi-arch manifest from a
single `docker buildx build --platform linux/amd64,linux/arm64`. The
builder stage runs on the host's native arch ($BUILDPLATFORM) and Go
cross-compiles to each requested $TARGETARCH via the Makefile's
build-$TARGETARCH targets — no qemu-emulated builder, no per-arch
Dockerfile duplication. VERSION/COMMIT/DATE flow from --build-arg
through to the -ldflags -X injection so images stamp the same metadata
as `make build` on bare metal.

docker-compose.yml gains Docker Compose "profiles" (collector,
aggregator, frontend) and an `env_file: .env`, mirroring vpp-maglev's
pattern. All three services ship from one multi-arch image and select
their binary via `command:`. Collector uses network_mode: host so UDP
from host nginx on 127.0.0.1 actually reaches it; aggregator/frontend
bridge-network with published ports.

.env.example documents every COLLECTOR_*, AGGREGATOR_*, FRONTEND_* env
var with its default plus COMPOSE_PROFILES and notes for Docker-specific
cases (service DNS names, AGGREGATOR_COLLECTORS spelling). .gitignore
excludes /.env so local tunables stay local.

Verified: `docker buildx build --platform linux/amd64,linux/arm64` goes
through cleanly from one invocation; local --load build's four binaries
report version 0.9.1 with the injected commit/date.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -1,21 +1,64 @@
-FROM golang:1.24-alpine AS builder
+# syntax=docker/dockerfile:1.6
+#
+# Multi-stage, multi-arch build for nginx-logtail.
+#
+# A single `docker buildx build --platform linux/amd64,linux/arm64`
+# produces a proper multi-arch manifest without a qemu-emulated builder:
+# the builder runs on the host's $BUILDPLATFORM and Go cross-compiles
+# to each requested $TARGETARCH via the Makefile's build-amd64 /
+# build-arm64 targets. Both BUILDPLATFORM and TARGETARCH are populated
+# automatically by buildx.
+#
+# One runtime image contains all four binaries; docker-compose.yml
+# picks which one each service runs via `command:`.
+#
+# Driven from the Makefile:
+#   make docker           # native arch, --load into local daemon
+#   make docker-push      # multi-arch manifest, pushed to the registry
 
+# =============================================================================
+# Builder — compiles all four binaries on the host's native arch.
+# =============================================================================
+FROM --platform=$BUILDPLATFORM golang:1.24-alpine AS builder
+
+# TARGETARCH (amd64, arm64, ...) is supplied by buildx; VERSION/COMMIT/DATE
+# come in as --build-arg from `make docker` / `make docker-push`.
+ARG TARGETARCH
 ARG VERSION=dev
 ARG COMMIT=unknown
 ARG DATE=unknown
 
-ENV CGO_ENABLED=0 \
-    LDFLAGS="-s -w -X git.ipng.ch/ipng/nginx-logtail/internal/version.Version=${VERSION} -X git.ipng.ch/ipng/nginx-logtail/internal/version.Commit=${COMMIT} -X git.ipng.ch/ipng/nginx-logtail/internal/version.Date=${DATE}"
+# make drives the build. git lets the Makefile stamp a commit hash via
+# `git rev-parse` when --build-arg COMMIT isn't supplied; when it is,
+# the command-line override below wins and git is only needed to avoid
+# the fallback branch warning.
+RUN apk add --no-cache make git
 
 WORKDIR /src
+
+# Cache Go modules so code-only rebuilds skip the download.
 COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN go build -trimpath -ldflags="${LDFLAGS}" -o /out/collector  ./cmd/collector  && \
-    go build -trimpath -ldflags="${LDFLAGS}" -o /out/aggregator ./cmd/aggregator && \
-    go build -trimpath -ldflags="${LDFLAGS}" -o /out/frontend   ./cmd/frontend   && \
-    go build -trimpath -ldflags="${LDFLAGS}" -o /out/cli        ./cmd/cli
 
+# Generated proto files are checked in, but `docker COPY` resets mtimes,
+# which can make `make` think they are stale relative to the .proto
+# source. Touch them so the regen rule is skipped.
+RUN touch proto/logtailpb/logtail.pb.go proto/logtailpb/logtail_grpc.pb.go
+
+# The Makefile's build-<arch> target sets GOOS=linux GOARCH=<arch>
+# CGO_ENABLED=0 and emits build/<arch>/<binary> with the usual -ldflags
+# version injection. Forwarding VERSION/COMMIT_HASH/DATE on the command
+# line stamps the values supplied by --build-arg into the binaries.
+RUN make VERSION=$VERSION COMMIT_HASH=$COMMIT DATE=$DATE build-$TARGETARCH
+
+# =============================================================================
+# Runtime — scratch, no OS, no shell. All four binaries.
+# =============================================================================
 FROM scratch
-COPY --from=builder /out/ /usr/local/bin/
+ARG TARGETARCH
+COPY --from=builder /src/build/$TARGETARCH/collector  /usr/local/bin/collector
+COPY --from=builder /src/build/$TARGETARCH/aggregator /usr/local/bin/aggregator
+COPY --from=builder /src/build/$TARGETARCH/frontend   /usr/local/bin/frontend
+COPY --from=builder /src/build/$TARGETARCH/cli        /usr/local/bin/cli