# JVM image built from an artifact that already exists on the host:
#   ./mvnw package -DskipTests && docker build -f docker/Dockerfile.jvm-package -t floci/floci:dev .
#
# The counterpart to Dockerfile.native-package, for the JVM runtime: same idea, same reason. It
# exists for the local loop: docker/Dockerfile runs Maven inside the build, which re-resolves every
# dependency and wants a couple of gigabytes, so iterating on a change through it is slow and can
# fall over on a machine with little headroom. Consuming target/quarkus-app takes seconds.
#
# Everything below the FROM is a copy of the runtime stage of docker/Dockerfile, which is the
# canonical definition. Exactly two lines differ, both by design: the default VERSION, and where
# the application directory is copied from. DockerfileRuntimeParityTest enforces that, so a change
# to the canonical runtime stage fails the build here until it is mirrored.
FROM eclipse-temurin:25-jre-noble

ARG VERSION=dev
ENV FLOCI_VERSION=${VERSION}
ENV FLOCI_STORAGE_PERSISTENT_PATH=/app/data

ENV AWS_DEFAULT_REGION=us-east-1
ENV AWS_ACCESS_KEY_ID=test
ENV AWS_SECRET_ACCESS_KEY=test
ENV AWS_CONFIG_FILE=/etc/floci/aws/config

# Privilege drop happens in the entrypoint through coreutils chroot, so no gosu
# download; wget stays for the HEALTHCHECK below.
RUN set -eux; \
    apt-get update; \
    apt-get install -y --no-install-recommends ca-certificates passwd python3 python3-pip wget; \
    rm -rf /var/lib/apt/lists/*; \
    pip3 install --no-cache-dir --break-system-packages awscli boto3; \
    aws_bin="$(command -v aws)"; \
    mv "$aws_bin" /usr/bin/aws.real; \
    printf '#!/bin/sh\nexec /usr/bin/aws.real --endpoint-url=http://localhost:4566 "$@"\n' > /usr/bin/aws; \
    chmod +x /usr/bin/aws; \
    useradd -r -u 1001 -g root -d /app -s /sbin/nologin floci

WORKDIR /app

# cli_follow_urlparam: the bundled CLI is v1 (pip ships no v2), where a parameter value that looks
# like a URL is *fetched* and its body used as the value. An init hook putting an SSM parameter such
# as MY_API_URL=https://example.com then fails with "Unable to retrieve https://…", and a hook that
# backgrounds its calls loses that silently. AWS CLI v2 dropped the behaviour, so this only shows up
# in the image, never when the same script is run from a host with v2.
RUN mkdir -p /app/data /etc/floci/aws \
    && printf '[default]\nendpoint_url = http://localhost:4566\ncli_follow_urlparam = false\n' > /etc/floci/aws/config \
    && chown 1001:root /app \
    && chmod "g+rwX" /app \
    && chown 1001:root /app/data

COPY target/quarkus-app/ quarkus-app/
RUN chown -R 1001:root /app/quarkus-app

COPY --chmod=755 docker/entrypoint.sh /usr/local/bin/docker-entrypoint.sh
COPY --chmod=755 docker/localstack-parity.sh /usr/local/bin/localstack-parity.sh

VOLUME /app/data

EXPOSE 4566

# Need to expose separately due to https://github.com/floci-io/floci/issues/2095.
# This preseres compatibility with https://github.com/docker-java/docker-java/blob/002b6eb7aa2b892be729c7c2a5e95f782924db38/docker-java-api/src/main/java/com/github/dockerjava/api/model/ExposedPort.java#L119
EXPOSE 6379
EXPOSE 6380
EXPOSE 6381
EXPOSE 6382
EXPOSE 6383
EXPOSE 6384
EXPOSE 6385
EXPOSE 6386
EXPOSE 6387
EXPOSE 6388
EXPOSE 6389
EXPOSE 6390
EXPOSE 6391
EXPOSE 6392
EXPOSE 6393
EXPOSE 6394
EXPOSE 6395
EXPOSE 6396
EXPOSE 6397
EXPOSE 6398
EXPOSE 6399

HEALTHCHECK --interval=5s --timeout=3s --retries=5 \
    CMD wget -q --spider http://localhost:4566/_floci/health || exit 1

ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
# A published port needs 0.0.0.0 inside the container, which Floci only accepts with explicit consent.
CMD ["java", "--enable-native-access=ALL-UNNAMED", "-Dquarkus.http.host=0.0.0.0", "-Dfloci.security.allow-unsafe-network-exposure=true", "-jar", "/app/quarkus-app/quarkus-run.jar"]