feat: runtime manager

game/Dockerfile

@@ -0,0 +1,60 @@
+# syntax=docker/dockerfile:1.7
+
+# Build context is the workspace root (galaxy/), not the game/ subdirectory,
+# because the game module pulls galaxy/{calc,error,model,util} through the
+# go.work replace directives. Build with:
+#
+#     docker build -t galaxy/game:test -f game/Dockerfile .
+
+FROM golang:1.26.2-alpine AS builder
+WORKDIR /src
+ENV CGO_ENABLED=0 GOFLAGS=-trimpath
+
+# Only the four pkg/ modules the engine binary actually imports.
+COPY pkg/calc/   ./pkg/calc/
+COPY pkg/error/  ./pkg/error/
+COPY pkg/model/  ./pkg/model/
+COPY pkg/util/   ./pkg/util/
+COPY game/       ./game/
+
+# Minimal workspace. The repository-level go.work also lists service
+# modules (lobby, notification, ...) that the engine binary does not
+# need, so we synthesise a workspace tailored to this image instead of
+# dragging the rest of the monorepo into the build context.
+RUN <<'EOF' cat > go.work
+go 1.26.2
+
+use (
+	./game
+	./pkg/calc
+	./pkg/error
+	./pkg/model
+	./pkg/util
+)
+
+replace (
+	galaxy/calc v0.0.0  => ./pkg/calc
+	galaxy/error v0.0.0 => ./pkg/error
+	galaxy/model v0.0.0 => ./pkg/model
+	galaxy/util v0.0.0  => ./pkg/util
+)
+EOF
+
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/go/pkg/mod \
+    go build -ldflags="-s -w" -o /out/server ./game/cmd/http
+
+FROM gcr.io/distroless/static-debian12:nonroot AS runtime
+
+LABEL com.galaxy.cpu_quota="1.0"
+LABEL com.galaxy.memory="512m"
+LABEL com.galaxy.pids_limit="512"
+LABEL org.opencontainers.image.title="galaxy-game-engine"
+
+ENV STORAGE_PATH=/var/lib/galaxy-game
+EXPOSE 8080
+USER nonroot:nonroot
+
+COPY --from=builder /out/server /usr/local/bin/server
+
+ENTRYPOINT ["/usr/local/bin/server"]