# https://github.com/containers/podman/blob/main/contrib/podmanimage/stable/Containerfile
# https://hub.docker.com/r/jenkins/inbound-agent/tags

ARG BASE="alpine-jdk17"

FROM jenkins/inbound-agent:${BASE}

ARG BUILDUSER=jenkins

USER root
RUN echo "@edge-testing http://dl-cdn.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories && \
    apk upgrade -U --available --no-cache && \
    apk add --no-cache \
      tini \
      make \
      yq \
      strace \
      podman \
      buildah \
      py3-pip \
      aws-cli \
      trivy@edge-testing

# Trivy html template
ADD --chown=$BUILDUSER:$BUILDUSER html.tpl /home/$BUILDUSER

# Rootless podman
RUN mkdir -p /home/$BUILDUSER/.config/containers

ADD entrypoint.sh /usr/local/bin/entrypoint.sh
# conf/registries.conf will be mounted RO at runtime to inherit worker settings incl. caching proxies
ADD --chown=$BUILDUSER:$BUILDUSER conf/containers.conf conf/storage.conf /home/$BUILDUSER/.config/containers

RUN echo -e "$BUILDUSER:1:999\n$BUILDUSER:1001:64535" > /etc/subuid && \
    echo -e "$BUILDUSER:1:999\n$BUILDUSER:1001:64535" > /etc/subgid && \
    cd /usr/bin && ln -s podman docker && \
    chown $BUILDUSER:$BUILDUSER -R /home/$BUILDUSER

# Patch jenkins-agent to launch podman service
RUN sed -i -e 's/exec \$JAVA_BIN/podman system service -t0\&\n        exec \$JAVA_BIN/' /usr/local/bin/jenkins-agent

ENV XDG_RUNTIME_DIR=/home/$BUILDUSER/agent/xdg-run
ENV BUILDAH_ISOLATION=chroot
ENV _CONTAINERS_USERNS_CONFIGURED=""
ENV TRIVY_TEMPLATE="@/home/jenkins/html.tpl"
ENV HOME=/home/$BUILDUSER

USER $BUILDUSER

# Install detect-secrets
ENV PATH=$PATH:/home/${BUILDUSER}/.local/bin
RUN pip install detect-secrets --user

ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/entrypoint.sh"]