# Copyright 2022 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

FROM ubuntu:26.04@sha256:f144425ff09be612d6d9ad965196e9cdc23dae1f42110a8a11a3e9a8198759f7

ENV DEBIAN_FRONTEND noninteractive
RUN apt-get update && apt-get upgrade -y && \
    apt-get install -y \
    apt-transport-https \
    build-essential \
    ca-certificates \
    curl \
    git \
    gnupg-agent \
    zlib1g-dev \
    libffi-dev \
    libssl-dev \
    software-properties-common

ARG PYTHON_VERSION=3.13.3
RUN curl -sS https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tgz | tar -C /tmp -xzv && \
    cd /tmp/Python-${PYTHON_VERSION} && \
    ./configure --enable-optimizations --with-lto --enable-loadable-sqlite-extensions && \
    make -j && \
    make install && \
    rm -rf /tmp/Python-${PYTHON_VERSION}

# Setup Poetry in its own virtual environment.
# So when poetry changes the system dependencies, it doesn't mess with its own dependencies
# when managing our dependencies.
# See: https://python-poetry.org/docs/#installation 
ENV POETRY_HOME "/opt/poetry"
COPY docker/poetry/requirements.txt ./poetry-requirements.txt
RUN python3 -m venv $POETRY_HOME && \
    $POETRY_HOME/bin/pip install --require-hashes -r ./poetry-requirements.txt && \
    ln -s $POETRY_HOME/bin/poetry /usr/local/bin/poetry

# Keep the virtualenv directly in the project directory. This isn't strictly neccesary for
# this image as it runs on kubernetes, but it keeps it consistent with other cloud run images.
ENV POETRY_VIRTUALENVS_IN_PROJECT=true

# Install Docker.
ARG DOCKER_VERSION=5:29.3.0-1~ubuntu.24.04~noble
RUN curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/trusted.gpg.d/docker.gpg && \
    add-apt-repository \
    "deb [arch=amd64] https://download.docker.com/linux/ubuntu noble stable" && \
    apt-get install -y docker-ce=$DOCKER_VERSION docker-ce-cli=$DOCKER_VERSION && \
    apt-mark hold docker-ce docker-ce-cli  # Prevent subsequent upgrades from bumping the version.

# Replace ulimit calls with 'true' to avoid empty if/else blocks and "Invalid argument" errors
RUN sed -i 's/^.*ulimit.*$/true/g' /etc/init.d/docker

# Install gcloud
RUN echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | tee -a /etc/apt/sources.list.d/google-cloud-sdk.list && \
    curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg && \
    apt-get update && apt-get install -y google-cloud-cli

# Install gVisor.
RUN curl -fsSL https://gvisor.dev/archive.key | gpg --dearmor -o /etc/apt/trusted.gpg.d/gvisor.gpg && \
    # Pinning the version as the latest has a hash sum mismatch.
    add-apt-repository "deb https://storage.googleapis.com/gvisor/releases 20260309 main" && \
    apt-get update && apt-get install -y runsc

# Make gVisor the default Docker runtime.
COPY docker/worker-base/daemon.json /etc/docker/daemon.json
