# This is a build stage image
# We build the app in this image to reduce the number of dependencies and packages
# at runtime. This should result in fewer security findings over time
FROM ghcr.io/github/gh-base-image/gh-builder-focal:20250725-230644-gc2200759f@sha256:cdad63d2312e8ad1f889159a39985c7e8e43492a6c930a87d1123f12c3e02d18 AS base

# By referencing the version in `.ruby-version`, we don't need to update this 
# Dockerfile everytime we upgrade ruby.
COPY .ruby-version .ruby-version

# This will update /usr/share/rbenv/shims/
# note: this step requires access to packages.service, so you'll need to connect to
# devvpn to build this image.


# We passed pkg-mirror-host as a secret to the build but it is not sensitive data.
RUN --mount=type=secret,id=pkg-mirror-host,target=/etc/pkg_mirror_host.txt \
    if [ -f /etc/pkg_mirror_host.txt ]; then cat /etc/pkg_mirror_host.txt >> /etc/apt/mirrorlist.txt; fi

RUN --mount=type=secret,id=apt-auth-conf,target=/etc/apt/auth.conf.d/apt_auth.conf \
    apt-get -qq update && apt-get -qq install --no-install-recommends rbenv-$(cat .ruby-version) && rbenv global $(cat .ruby-version)

# INSTALL BUILD DEPENDENCIES HERE
RUN --mount=type=secret,id=apt-auth-conf,target=/etc/apt/auth.conf.d/apt_auth.conf \
    apt-get -qq update && apt-get --no-install-recommends install -y build-essential make gcc g++ libgmp-dev default-libmysqlclient-dev

 # Copy your app files and run bootstrap to set up the environment
WORKDIR /app
COPY . .
RUN  RACK_ENV=production script/bootstrap

# application specific build steps go here

# This is the execution stage image and where your code will run
# You must make your runtime dependencies available in this image
FROM ghcr.io/github/gh-base-image/gh-base-focal:20250711-165924-g6f92253c7@sha256:9d7f0e43a51322561f139d9c09a3ce2e349a800c794e65f71869616e3731a618

# BOILERPLATE FOR RUBY APPS

# We passed pkg-mirror-host as a secret to the build but it is not sensitive data.
RUN --mount=type=secret,id=pkg-mirror-host,target=/etc/pkg_mirror_host.txt \
    if [ -f /etc/pkg_mirror_host.txt ]; then cat /etc/pkg_mirror_host.txt >> /etc/apt/mirrorlist.txt; fi

RUN --mount=type=secret,id=apt-auth-conf,target=/etc/apt/auth.conf.d/apt_auth.conf \
    apt-get -qq update && apt-get --no-install-recommends install -y libyaml-0-2 locales-all default-libmysqlclient-dev mysql-client

ENV PATH="/usr/share/rbenv/shims:/bin:$GEM_HOME/bin:${PATH}"
ENV LANG=en_US.UTF-8

# Ruby dependencies
COPY --from=base /usr/share/rbenv /usr/share/rbenv
COPY --from=base /usr/lib/x86_64-linux-gnu/libjemalloc.so.2 /usr/lib/x86_64-linux-gnu/libjemalloc.so.2

WORKDIR /app

# create nonroot user
RUN useradd -m nonroot

# Copy over the built assets from the builder image
COPY --chown=nonroot:nonroot --from=base /app /app
RUN chown nonroot:nonroot  /app
RUN  RACK_ENV=production script/bootstrap

# switch to the nonroot user
USER nonroot

## END BOILERPLATE

# Since we have no entry point this will let the console host exist
# See https://github.slack.com/archives/C1UFNH3FV/p1544556684289400 for more details
CMD sleep infinity
