# This default may be swapped for any compatible base image
ARG BASE_IMAGE=ubuntu:24.04

# Eclipse Temurin JRE for Java runtime
FROM eclipse-temurin:17.0.19_10-jre-noble AS java

FROM ${BASE_IMAGE} as base

RUN apt-get update -y && apt-get upgrade -y && apt-get install -y --no-install-recommends dumb-init && apt-get clean && rm -rf /var/lib/apt/lists/*

ARG USER_NAME=user
ARG USER_ID=1542
ARG APP_ROOT=/usr/src/app

# Create non-root user (replaces containerbase user setup, includes root group for OpenShift compatibility)
RUN groupadd --gid ${USER_ID} ${USER_NAME} && \
    useradd --uid ${USER_ID} --gid 0 --groups "0,${USER_ID}" --shell /bin/bash --create-home ${USER_NAME}

# Copy JRE from Temurin image
COPY --from=java /opt/java/openjdk /opt/java/openjdk
ENV JAVA_HOME=/opt/java/openjdk
ENV PATH="${JAVA_HOME}/bin:${PATH}"
# Force UTF-8 as the JVM charset; the Temurin JRE base image sets no locale, so file.encoding otherwise defaults to US-ASCII (unlike the previous containerbase image)
ENV LANG=C.UTF-8
ENV LC_ALL=C.UTF-8

# Block the CVE-2026-91403 compromised intermediate CAs (OpenJDK 2026-10-21 advisory) until the JRE ships them;
# kept above the base-image marker so the split base image (docker-base-images) gets it too
RUN printf '%s\n' "" \
    42C4ACCD12C4F59597925E1A08A7A90102608543809308D50EC427E118BA1493 \
    45A883F349AEDFD5F3A649B5498FFB121712BA8B448F3F2A91DBC5A766FCDDBE \
    98B896625C0C230ADEEC3EB2CF6AAD5001ECF9156A68644E82374CE5833BC25B \
    5F1DED4DD590AF74631290CF073B122A2AAC6A1FA479778A0BD43579BD832699 \
    E7568FE6E12331F4FD7DE61DA4C7559D0F8EB192A218D4741A3BA75184333838 \
    579480AEA166290BD3C643589E795FC0D0E54E86505D180F1DFF99EFD3199512 \
    0164D7CEAE5BB909C272AF151FF44B1177AE9B47D9424B94F1D9558C30934D19 \
    62B7F9868263F72F6911FC78CEAF72C1979158B7368BF648683BB2AA39B02E72 \
    CB6E15165AC802E9B3F993F16C25D41F4E81C21EBDE71AE1B012AC00BF9C7C3F \
    7485B51C0ED192878FA1D2F948FB529AE1842CC5086C4B67F7BE5B2039DE9489 \
    432EC25F0D28DE9006D97BF752F17BBB2CD41F669933FCB072D9A1148D0261F3 \
    FD9D5C2DBBD4995AB69B8D50C439D9527B00529199C2FD01B2174EB58F07021F \
    9E39DE2881273ACC225A149C72BA3E0F51424963669AB633EE1DC7DF5DB067B4 \
    A496E23AC0CAB8155FC9B117B97EAE368EFCBB9041AEC8804D5A308D2D01C2D8 \
    4B2460A466F95FD40113BCDCCA2CEB29B3B093921DE45474DA7DF48874C630B1 \
    84112972B8E59D14560AE7E7119654474AAD119990CF3722BFC1E3B91615E1FD \
    >> "$JAVA_HOME/lib/security/blocked.certs" \
    && grep -qxi "42C4ACCD12C4F59597925E1A08A7A90102608543809308D50EC427E118BA1493" "$JAVA_HOME/lib/security/blocked.certs"

# END OF BASE IMAGE

# copy folder
COPY docker-image/ /

# Expose ports
# HTTP
EXPOSE 5678

# home directory
ENV HOME=/etc/usr/local/whitesource
ENV WHITESOURCE_HOME=$HOME
ENV BOLT4SCM_HOME=$HOME/bolt4scm

ARG JAVA_OPTS
ENV JAVA_OPTS=${JAVA_OPTS}
ENV JDK_JAVA_OPTIONS "--add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.net=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED -Dfile.encoding=UTF-8"

RUN chmod -R ugo+rw $HOME && chmod +x /start.sh

USER $USER_ID

# dumb-init as PID 1 for proper signal handling
ENTRYPOINT [ "dumb-init", "--" ]
# Mend traceability labels
LABEL io.mend.image.dockerfile.path=integration/bolt-packaging/wss-gls-app/src/assembly-staging/docker/Dockerfile
LABEL org.opencontainers.image.source=https://github.com/whitesource/thunder

CMD [ "./start.sh" ]
