build: make Go image build resilient to registry mirror failures

backend/Dockerfile.runtime

@@ -0,0 +1,24 @@
+# syntax=docker/dockerfile:1
+# Runtime-only image for build environments whose registry mirror cannot serve
+# the golang builder image. Build the static binary first (any machine with
+# Go 1.21, no Docker required), then assemble this image from alpine only:
+#
+#   cd backend
+#   CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+#     go build -trimpath -ldflags="-s -w" -o zhinian-api.linux ./cmd/zhinian-api
+#   docker build -f backend/Dockerfile.runtime \
+#     -t REGISTRY/PROJECT/zhinian-go-api:TAG backend/
+#
+# RUNTIME_IMAGE is overridable the same way as in Dockerfile.
+ARG RUNTIME_IMAGE=alpine:3.20
+
+FROM ${RUNTIME_IMAGE}
+RUN apk add --no-cache ca-certificates tzdata \
+    && addgroup -S -g 10001 zhinian \
+    && adduser -S -D -H -u 10001 -G zhinian zhinian \
+    && mkdir -p /var/lib/zhinian \
+    && chown -R zhinian:zhinian /var/lib/zhinian
+COPY zhinian-api.linux /usr/local/bin/zhinian-api
+USER 10001:10001
+EXPOSE 8080
+ENTRYPOINT ["zhinian-api"]