# This Dockerfile builds our base image with gosu, dumb-init and the atlantis
# user. We split this from the main Dockerfile because this base doesn't change
# and also because it kept breaking the build due to flakiness.
FROM debian:11.6-slim

# We use gosu to step down from root and run as the atlantis user so we need
# to create that user and group.
# We add the atlantis user to the root group and make its home directory
# owned by root so that OpenShift users can use /home/atlantis as their
# data dir because OpenShift runs containers as a random uid that's part of
# the root group.
RUN useradd --create-home --user-group --shell /bin/bash atlantis && \
    adduser atlantis root && \
    chown atlantis:root /home/atlantis/ && \
    chmod g=u /home/atlantis/ && \
    chmod g=u /etc/passwd

# Install gosu and git-lfs.
ENV GOSU_VERSION=1.16
ENV GIT_LFS_VERSION=3.3.0

# Automatically populated with the architecture the image is being built for.
ARG TARGETPLATFORM

# Install packages needed for running Atlantis.
# hadolint ignore explanation
# DL3008 (pin versions using "=") - Ignored to avoid failing the build
# SC2261 (multiple redirections) - This is a bug https://github.com/hadolint/hadolint/issues/782
# hadolint ignore=DL3008,SC2261
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        ca-certificates>=20210119 \
        curl>=7.74 \
        git>=1:2.30 \
        unzip>=6.0 \
        bash>=5.1 \
        openssh-server>=1:8.4p1 \
        libcap2>=1:2.44 \
        dumb-init>=1.2 \
    # Install packages needed for building dependencies.
    && apt-get install -y --no-install-recommends \
        gnupg>=2.2 \
        openssl>=1.1.1n && \
    mkdir -p /tmp/build && \
    cd /tmp/build && \
    # git-lfs
    case ${TARGETPLATFORM} in \
        "linux/amd64") GIT_LFS_ARCH=amd64 ;; \
        "linux/arm64") GIT_LFS_ARCH=arm64 ;; \
        "linux/arm/v7") GIT_LFS_ARCH=arm ;; \
    esac && \
    curl -L -s --output git-lfs.tar.gz "https://github.com/git-lfs/git-lfs/releases/download/v${GIT_LFS_VERSION}/git-lfs-linux-${GIT_LFS_ARCH}-v${GIT_LFS_VERSION}.tar.gz" && \
    tar --strip-components=1 -xf git-lfs.tar.gz && \
    chmod +x git-lfs && \
    mv git-lfs /usr/bin/git-lfs && \
    git-lfs --version && \
    # gosu
    case ${TARGETPLATFORM} in \
        "linux/amd64") GOSU_ARCH=amd64 ;; \
        "linux/arm64") GOSU_ARCH=arm64 ;; \
        "linux/arm/v7") GOSU_ARCH=armhf ;; \
    esac && \
    curl -L -s --output gosu "https://github.com/tianon/gosu/releases/download/${GOSU_VERSION}/gosu-${GOSU_ARCH}" && \
    curl -L -s --output gosu.asc "https://github.com/tianon/gosu/releases/download/${GOSU_VERSION}/gosu-${GOSU_ARCH}.asc" && \
    for server in $(shuf -e ipv4.pool.sks-keyservers.net \
                            hkp://p80.pool.sks-keyservers.net:80 \
                            keyserver.ubuntu.com \
                            hkp://keyserver.ubuntu.com:80 \
                            pgp.mit.edu) ; do \
        gpg --keyserver "$server" --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 && break || : ; \
    done && \
    gpg --batch --verify gosu.asc gosu && \
    chmod +x gosu && \
    cp gosu /bin && \
    gosu --version && \
    # Cleanup
    cd /tmp && \
    rm -rf /tmp/build && \
    gpgconf --kill dirmngr && \
    gpgconf --kill gpg-agent && \
    rm -rf /root/.gnupg