# syntax=docker/dockerfile:1

ARG UBUNTU_VERSION=24.04
# ARG TEMURIN_IMAGE=eclipse-temurin:25-jdk-noble

# ==========================================
# Build libvips
# ==========================================
FROM ubuntu:${UBUNTU_VERSION} AS vips-build

ARG DEBIAN_FRONTEND=noninteractive

RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    ca-certificates \
    cmake \
    curl \
    glib2.0-dev \
    jq \
    libbrotli-dev \
    libde265-dev \
    libexif-dev \
    libexpat1-dev \
    libimagequant-dev \
    liblcms2-dev \
    meson \
    nasm \
    ninja-build \
    pkg-config \
    xz-utils \
    && rm -rf /var/lib/apt/lists/*

COPY scripts/native-build/ /usr/local/src/native-build/

RUN bash /usr/local/src/native-build/install.sh

ENV PKG_CONFIG_PATH=/opt/konifer-native/lib/pkgconfig
ENV CMAKE_PREFIX_PATH=/opt/konifer-native

COPY scripts/install-vips.sh /usr/local/bin/install-vips.sh

RUN chmod +x /usr/local/bin/install-vips.sh \
    && /usr/local/bin/install-vips.sh --cleanup \
    && bash /usr/local/src/native-build/generate-sbom.sh

# ==========================================
# Install Temurin JDK
# ==========================================
FROM ubuntu:${UBUNTU_VERSION} AS temurin-build

ARG DEBIAN_FRONTEND=noninteractive
ARG TARGETARCH

# Temporary workaround: eclipse-temurin:25-jdk-noble still contains 25.0.4+7,
# even though Adoptium has published the CVE-fixed 25.0.4.1+1 binaries. Restore
# this stage to `FROM eclipse-temurin:25-jdk-noble` once that tag ships the fix.
RUN apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates \
      curl \
    && rm -rf /var/lib/apt/lists/* \
    && case "$TARGETARCH" in \
      amd64) \
        TEMURIN_ARCH="x64"; \
        TEMURIN_SHA256="dbb698396d478e7fa2b1e50f4103324b2a99b90569ee27c33f2261f9215cf41e"; \
        ;; \
      arm64) \
        TEMURIN_ARCH="aarch64"; \
        TEMURIN_SHA256="69df11a02cfa3ef7d7ca645e03edce6778ec090e100f6ae2b42097865730ac52"; \
        ;; \
      *) \
        echo "Unsupported target architecture: $TARGETARCH" >&2; \
        exit 1; \
        ;; \
    esac \
    && TEMURIN_ARCHIVE="OpenJDK25U-jdk_${TEMURIN_ARCH}_linux_hotspot_25.0.4.1_1.tar.gz" \
    && curl --fail --location --show-error --silent --retry 3 \
      --output /tmp/openjdk.tar.gz \
      "https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.4.1%2B1/${TEMURIN_ARCHIVE}" \
    && echo "${TEMURIN_SHA256}  /tmp/openjdk.tar.gz" | sha256sum --check --strict \
    && install -d /opt/java/openjdk \
    && tar --extract \
      --file /tmp/openjdk.tar.gz \
      --directory /opt/java/openjdk \
      --strip-components 1 \
      --no-same-owner \
    && rm -f /tmp/openjdk.tar.gz /opt/java/openjdk/lib/src.zip \
    && rm -rf /opt/java/openjdk/man /opt/java/openjdk/jmods

# Replace the whole stage with this
# And uncomment TEMURIN_IMAGE above
# FROM ${TEMURIN_IMAGE} AS temurin-build
#
# RUN rm -f "$JAVA_HOME/lib/src.zip" \
#     && rm -rf "$JAVA_HOME/man" \
#     && rm -rf "$JAVA_HOME/jmods"

# ==========================================
# Shared Runtime Base
# ==========================================
FROM ubuntu:${UBUNTU_VERSION} AS runtime

ARG DEBIAN_FRONTEND=noninteractive
ARG TARGETARCH

## Generated from scripts/query-runtime-deps.sh.
## Addresses CVE-2026-109518
RUN apt-get update \
    && apt-get install -y --no-install-recommends -o Acquire::Retries=0 \
        --only-upgrade apt libapt-pkg6.0t64 \
    && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' apt)" ge 2.8.4ubuntu0.1 \
    && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libapt-pkg6.0t64)" ge 2.8.4ubuntu0.1 \
    && apt-get install -y --no-install-recommends \
    ca-certificates \
    libbrotli1 \
    libde265-0 \
    libexif12 \
    libexpat1 \
    libffi8 \
    libgirepository-2.0-0 \
    libglib2.0-0t64 \
    libimagequant0 \
    libjemalloc2 \
    liblcms2-2 \
    libpng16-16t64 \
    tini \
    && rm -rf /var/lib/apt/lists/*

# Tell JVM FFM consumers how to find GLib.
RUN if [ "$TARGETARCH" = "arm64" ]; then GNU_ARCH="aarch64-linux-gnu"; else GNU_ARCH="x86_64-linux-gnu"; fi && \
    cd /usr/lib/$GNU_ARCH && \
    ln -s libglib-2.0.so.0 libglib-2.0.so && \
    ln -s libgobject-2.0.so.0 libgobject-2.0.so && \
    ln -s libgmodule-2.0.so.0 libgmodule-2.0.so

ENV JAVA_HOME=/opt/java/openjdk
ENV PATH=$JAVA_HOME/bin:$PATH
ENV LD_LIBRARY_PATH=/opt/konifer-native/lib

COPY --from=temurin-build /opt/java/openjdk /opt/java/openjdk
COPY --from=vips-build /opt/konifer-native /opt/konifer-native
COPY --from=vips-build /usr/local /usr/local
COPY scripts/verify-native-runtime.sh /usr/local/bin/verify-native-runtime
RUN rm -rf \
      /opt/konifer-native/include \
      /opt/konifer-native/lib/cmake \
      /opt/konifer-native/lib/pkgconfig \
      /opt/konifer-native/share/doc \
    && ldconfig \
    && /usr/local/bin/verify-native-runtime

ENV LD_PRELOAD="libjemalloc.so.2"
ENV SVT_LOG=1

# ==========================================
# CI Base
# ==========================================
FROM runtime AS ci

ARG DEBIAN_FRONTEND=noninteractive

RUN apt-get update && apt-get install -y --no-install-recommends \
    bash \
    curl \
    git \
    gzip \
    jq \
    openssh-client \
    tar \
    unzip \
    wget \
    xz-utils \
    zip \
    gpg \
    && rm -rf /var/lib/apt/lists/*

RUN install -m 0755 -d /etc/apt/keyrings \
    && curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc \
    && chmod a+r /etc/apt/keyrings/docker.asc \
    && . /etc/os-release \
    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu ${UBUNTU_CODENAME:-$VERSION_CODENAME} stable" > /etc/apt/sources.list.d/docker.list \
    && apt-get update \
    && apt-get install -y --no-install-recommends docker-ce-cli \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /workspace

# Keep plain `docker build -f Dockerfile.base .` focused on the deployable runtime image.
FROM runtime AS default