# Copyright 2026 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# ====================================================================================
# HOW TO BUILD THIS DOCKERFILE LOCALLY:
# 
# Because go/go.mod contains a relative replacement directive for bindings/go, 
# you must build this Dockerfile from the go/ directory and explicitly map 
# the sibling bindings/ folder in BuildKit using --build-context:
# 
#   cd go
#   docker build -t osv/importer --target importer --build-context bindings=../bindings -f Dockerfile .
#   docker build -t osv/website --target website --build-context bindings=../bindings --build-context website-dist=../website/dist --build-context docs=../docs -f Dockerfile .
# 
# Select which service to build using the --target flag (e.g. importer, worker, exporter,
# relations, recordchecker, generatesitemap, custommetrics, gitter, first_package_finder,
# api, recoverer, vanir-signatures, ubuntubinarymapper, staging-api-test, website).
# ====================================================================================

# ========================================================
# Shared Builder Stage
# ========================================================
FROM golang:1.27.1-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS builder

WORKDIR /workspace

# Mount the 'bindings' context into the container's filesystem
COPY --from=bindings . /workspace/bindings/

# Copy the main Go module (strictly go/)
COPY . /workspace/go/

WORKDIR /workspace/go
RUN go mod download && go mod verify

# ========================================================
# Target: Importer
# ========================================================
FROM builder AS importer-build
RUN CGO_ENABLED=0 go build -o /app/importer ./cmd/importer/

FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS importer
# Need to install the full tar package, to not use the busybox version, which doesn't have --zstd support.
RUN apk add --no-cache git zstd tar
COPY --from=importer-build /app/importer /
ENTRYPOINT ["/importer"]

# ========================================================
# Target: Worker
# ========================================================
FROM builder AS worker-build
RUN CGO_ENABLED=0 go build -o /app/worker ./cmd/worker/

FROM gcr.io/distroless/static-debian12@sha256:d75cdd72874d4790092fcb1b058493ecf6bb5bf2b2b897045b00ff01d91843f2 AS worker
COPY --from=worker-build /app/worker /
ENTRYPOINT ["/worker"]

# ========================================================
# Target: Exporter
# ========================================================
FROM builder AS exporter-build
RUN CGO_ENABLED=0 go build -o /app/exporter ./cmd/exporter/

FROM gcr.io/distroless/static-debian12@sha256:d75cdd72874d4790092fcb1b058493ecf6bb5bf2b2b897045b00ff01d91843f2 AS exporter
COPY --from=exporter-build /app/exporter /
ENTRYPOINT ["/exporter"]

# ========================================================
# Target: Record Checker
# ========================================================
FROM builder AS recordchecker-build
RUN CGO_ENABLED=0 go build -o /app/recordchecker ./cmd/recordchecker/

FROM gcr.io/distroless/static-debian12@sha256:d75cdd72874d4790092fcb1b058493ecf6bb5bf2b2b897045b00ff01d91843f2 AS recordchecker
COPY --from=recordchecker-build /app/recordchecker /
ENTRYPOINT ["/recordchecker"]

# ========================================================
# Target: Relations
# ========================================================
FROM builder AS relations-build
RUN CGO_ENABLED=0 go build -o /app/relations ./cmd/relations/

FROM gcr.io/distroless/static-debian12@sha256:d75cdd72874d4790092fcb1b058493ecf6bb5bf2b2b897045b00ff01d91843f2 AS relations
COPY --from=relations-build /app/relations /
ENTRYPOINT ["/relations"]

# ========================================================
# Target: Generate Sitemap
# ========================================================
FROM builder AS generatesitemap-build
RUN CGO_ENABLED=0 go build -o /app/generatesitemap ./cmd/generatesitemap/

FROM gcr.io/distroless/static-debian12@sha256:d75cdd72874d4790092fcb1b058493ecf6bb5bf2b2b897045b00ff01d91843f2 AS generatesitemap
COPY --from=generatesitemap-build /app/generatesitemap /
ENTRYPOINT ["/generatesitemap"]

# ========================================================
# Target: Custom Metrics
# ========================================================
FROM builder AS custommetrics-build
RUN CGO_ENABLED=0 go build -o /app/custommetrics ./cmd/custommetrics/

FROM gcr.io/distroless/static-debian12@sha256:d75cdd72874d4790092fcb1b058493ecf6bb5bf2b2b897045b00ff01d91843f2 AS custommetrics
COPY --from=custommetrics-build /app/custommetrics /
ENTRYPOINT ["/custommetrics"]

# ========================================================
# Target: Gitter
# ========================================================
FROM builder AS gitter-build
RUN CGO_ENABLED=0 go build -o /app/gitter ./cmd/gitter/

FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS gitter
# Need to install the full tar package, to not use the busybox version, which doesn't have --zstd support.
RUN apk add --no-cache bash git zstd tar
# Set maintenance.autoDetach to false so git's automatic maintenance will not detach and run in the background
RUN git config --system maintenance.autoDetach false
COPY --from=gitter-build /app/gitter /
ENTRYPOINT ["/gitter"]

# ========================================================
# Target: First Package Finder
# ========================================================
FROM builder AS first_package_finder-build
RUN CGO_ENABLED=0 go build -o /app/first_package_finder ./cmd/first_package_finder/

FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS first_package_finder
COPY --from=first_package_finder-build /app/first_package_finder /
ENTRYPOINT ["/first_package_finder"]

# ========================================================
# Target: OSV API
# ========================================================
FROM builder AS api-build
RUN CGO_ENABLED=0 go build -o /app/api ./cmd/api/

FROM gcr.io/distroless/static-debian12@sha256:d75cdd72874d4790092fcb1b058493ecf6bb5bf2b2b897045b00ff01d91843f2 AS api
COPY --from=api-build /app/api /
ENTRYPOINT ["/api"]

# ========================================================
# Target: Recoverer
# ========================================================
FROM builder AS recoverer-build
RUN CGO_ENABLED=0 go build -o /app/recoverer ./cmd/recoverer/

FROM gcr.io/distroless/static-debian12@sha256:d75cdd72874d4790092fcb1b058493ecf6bb5bf2b2b897045b00ff01d91843f2 AS recoverer
COPY --from=recoverer-build /app/recoverer /
ENTRYPOINT ["/recoverer"]

# ========================================================
# Target: Staging API Test
# ========================================================
FROM builder AS staging-api-test-build
RUN CGO_ENABLED=0 go build -o /app/staging_api_test ./cmd/staging_api_test/

FROM gcr.io/distroless/static-debian12@sha256:d75cdd72874d4790092fcb1b058493ecf6bb5bf2b2b897045b00ff01d91843f2 AS staging-api-test
COPY --from=staging-api-test-build /app/staging_api_test /
ENTRYPOINT ["/staging_api_test"]

# ========================================================
# Target: Website
# ========================================================
FROM builder AS website-build
COPY --from=website-dist . /workspace/go/cmd/website/dist/
COPY --from=docs osv_service_v1.swagger.json /workspace/go/cmd/website/docs/
RUN CGO_ENABLED=0 go build -tags embedstatic -o /app/website ./cmd/website/

FROM gcr.io/distroless/static-debian12@sha256:d75cdd72874d4790092fcb1b058493ecf6bb5bf2b2b897045b00ff01d91843f2 AS website
COPY --from=website-build /app/website /
ENTRYPOINT ["/website"]

# ========================================================
# Target: Vanir Signatures
# ========================================================
FROM builder AS vanir-signatures-build
RUN CGO_ENABLED=0 go build -o /app/vanir_signatures ./cmd/vanir_signatures/

FROM python:3.13-slim@sha256:8d9d0b8bcf6506481eae4907c18f5e3e7902e629f5f6d684f9e7c32e85e3ddf0 AS vanir-python-deps
ENV POETRY_HOME="/opt/poetry"
COPY --from=poetry requirements.txt ./poetry-requirements.txt
RUN python3 -m venv $POETRY_HOME && \
    $POETRY_HOME/bin/pip install --no-cache-dir --require-hashes -r ./poetry-requirements.txt && \
    ln -s $POETRY_HOME/bin/poetry /usr/local/bin/poetry
WORKDIR /app
COPY cmd/vanir_signatures/pyproject.toml cmd/vanir_signatures/poetry.lock ./
COPY cmd/vanir_signatures/osv/pyproject.toml cmd/vanir_signatures/osv/README.md cmd/vanir_signatures/osv/vulnerability_pb2.py ./osv/
RUN POETRY_VIRTUALENVS_IN_PROJECT=true poetry install --only main --no-interaction --no-ansi

FROM python:3.13-slim@sha256:8d9d0b8bcf6506481eae4907c18f5e3e7902e629f5f6d684f9e7c32e85e3ddf0 AS vanir-signatures
RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates && rm -rf /var/lib/apt/lists/*
COPY --from=vanir-python-deps /app/.venv /app/.venv
ENV PATH="/app/.venv/bin:$PATH"
COPY --from=vanir-signatures-build /app/vanir_signatures /usr/local/bin/vanir_signatures
COPY cmd/vanir_signatures/generate_signatures.py /usr/local/bin/generate_signatures.py
RUN chmod 755 /usr/local/bin/generate_signatures.py
ENTRYPOINT ["/usr/local/bin/vanir_signatures"]

# ========================================================
# Target: Ubuntu Binary Mapper
# ========================================================
FROM builder AS ubuntubinarymapper-build
RUN CGO_ENABLED=0 go build -o /app/ubuntubinarymapper ./cmd/ubuntubinarymapper/

FROM gcr.io/distroless/static-debian12@sha256:d75cdd72874d4790092fcb1b058493ecf6bb5bf2b2b897045b00ff01d91843f2 AS ubuntubinarymapper
COPY --from=ubuntubinarymapper-build /app/ubuntubinarymapper /
ENTRYPOINT ["/ubuntubinarymapper"]

