# syntax=docker/dockerfile:1.4
# Stage 1: UI Builder
FROM --platform=$BUILDPLATFORM node:26-alpine AS ui-builder
ENV PNPM_HOME="/pnpm"
ENV PATH="$PNPM_HOME:$PATH"
RUN rm -f /usr/local/bin/yarn /usr/local/bin/yarnpkg && \
    npm install -g corepack@latest && corepack enable

WORKDIR /app
COPY ui/package.json ui/pnpm-lock.yaml ./
RUN pnpm install --frozen-lockfile
COPY ui/ ./
RUN pnpm build

# Stage 2: Go Builder
FROM --platform=$TARGETPLATFORM golang:1.27.3 AS go-builder
ARG LDFLAGS
ARG TARGETOS
ARG TARGETARCH
RUN if ! command -v g++ >/dev/null; then \
      apt-get update && \
      apt-get install -y --no-install-recommends g++ && \
      rm -rf /var/lib/apt/lists/*; \
    fi
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
COPY --from=ui-builder /app/dist/ ./internal/service/frontend/assets/
COPY schemas/dag.schema.json ./internal/service/frontend/assets/
RUN CGO_ENABLED=1 GOOS=$TARGETOS GOARCH=$TARGETARCH \
    go build -tags netgo,osusergo -ldflags="${LDFLAGS} -linkmode=external -extldflags=-static" -o ./bin/dagu ./cmd

# Stage 3: Final Image
FROM --platform=$TARGETPLATFORM ubuntu:24.04
ARG USER="dagu"
ARG USER_UID=1000
ARG USER_GID=$USER_UID
ARG DAGU_HOME="/var/lib/dagu"

# Install common tools
ENV DEBIAN_FRONTEND=noninteractive
# Install common tools without cache mounts to avoid multi-platform conflicts
RUN set -ex && \
    for attempt in 1 2 3 4 5; do \
      rm -rf /var/lib/apt/lists/*; \
      apt-get update -o Acquire::Retries=5 \
                     -o APT::Update::Error-Mode=any && \
      apt-get -o Acquire::Retries=5 install -y --no-install-recommends \
      sudo \
      tini \
      git \
      curl \
      wget \
      zip \
      unzip \
      tzdata \
      build-essential \
      jq \
      python3 \
      python3-pip \
      openjdk-17-jdk \
      nodejs \
      npm \
      ca-certificates \
      && break; \
      if [ "$attempt" = 5 ]; then exit 1; fi; \
      apt-get clean; \
      sleep $((attempt * 10)); \
    done && \
    apt-get clean && rm -rf /var/lib/apt/lists/*; \
    ln -sf /usr/bin/tini /usr/local/bin/tini

# Chromium for browser steps. Ubuntu ships Chromium only as a snap, so the
# build comes from Playwright, which provides amd64 and arm64. Playwright
# 1.61 is the last release that runs on Ubuntu's Node.js 18.
ARG TARGETARCH
ARG PLAYWRIGHT_VERSION=1.61.1
RUN set -ex; \
    if [ "$TARGETARCH" = "amd64" ] || [ "$TARGETARCH" = "arm64" ]; then \
      PLAYWRIGHT_BROWSERS_PATH=/opt/ms-playwright \
        npx --yes "playwright@${PLAYWRIGHT_VERSION}" install --with-deps --no-shell chromium && \
      ln -s "$(find /opt/ms-playwright -type f -name chrome -path '*/chromium-*' | head -n 1)" /usr/local/bin/chromium && \
      /usr/local/bin/chromium --version && \
      apt-get clean && rm -rf /var/lib/apt/lists/* /root/.npm; \
    fi
# Chromium keeps its sandbox. The seccomp profile it needs to start is
# bundled so that it can be copied out of the image; deploy/docker/browser has
# a Compose file that applies it.
ENV CHROME_PATH=/usr/local/bin/chromium
COPY deploy/docker/browser/seccomp-chromium.json /usr/share/dagu/seccomp-chromium.json

COPY --from=go-builder /app/bin/dagu /usr/local/bin/
COPY ./entrypoint.sh /entrypoint.sh

RUN set -eux; \
    # Try to create group with specified GID, fallback if GID in use
    (groupadd -g "${USER_GID}" "${USER}" || groupadd "${USER}") && \
    # Try to create user with specified UID, fallback if UID in use
    (useradd -m -d /home/${USER} \
              -u "${USER_UID}" \
              -g "$(getent group "${USER}" | cut -d: -f3)" \
              -s /bin/bash \
              "${USER}" \
    || useradd -m -d /home/${USER} \
               -g "$(getent group "${USER}" | cut -d: -f3)" \
               -s /bin/bash \
               "${USER}") && \
    chmod +x /entrypoint.sh

# Create user and set permissions
RUN set -eux; \
    { \
        echo 'dagu ALL=(ALL) NOPASSWD:ALL'; \
        echo 'Defaults:dagu !requiretty'; \
    } > /etc/sudoers.d/99-dagu && \
    chmod 0440 /etc/sudoers.d/99-dagu && \
    visudo -cf /etc/sudoers.d/99-dagu

# Delete the default ubuntu user if it exists
RUN userdel -f ubuntu || true

# Create the DAGU_HOME directory and set permissions
RUN mkdir -p "${DAGU_HOME}" && \
    chown -R "${USER_UID}:${USER_GID}" "${DAGU_HOME}" && \
    chmod 755 "${DAGU_HOME}"

WORKDIR /home/${USER}
ENV DAGU_HOST=0.0.0.0
ENV DAGU_PORT=8080
ENV DAGU_HOME=${DAGU_HOME}
ENV DAGU_TZ="Etc/UTC"
ENV PUID=${USER_UID}
ENV PGID=${USER_GID}
ENV DOCKER_GID=-1
EXPOSE 8080
ENTRYPOINT ["/usr/local/bin/tini", "-g", "--", "/entrypoint.sh"]
CMD ["dagu", "start-all"]