# To build this, run podman/buildah like this:
#
#     podman build --security-opt=label=disable --cap-add=all --device /dev/fuse \
#         --build-arg-file build-args.conf -v $PWD:/run/src . -t localhost/fedora-coreos
#
# Note: we should be able to drop the `-v $PWD:/run/src` once
# https://github.com/containers/buildah/issues/5952 is fixed.
#
# For development convenience, an `overrides/` directory in the context dir, or
# mounted at `/src/overrides` is supported:
# - The `overrides/rpm` directory can be a yum repo. Its packages take
#   precedence over those from remote repos.
# - The `overrides/rootfs` directory can contain files in a rootfs layout which
#   will be copied on top of the final rootfs.

# Overridden by build-args.conf. The value here is invalid on purpose.
ARG BUILDER_IMG=overridden

FROM ${BUILDER_IMG} as builder

ARG ID=overridden
ARG NAME=overridden
ARG VERSION=overridden
ARG DESCRIPTION=overridden
ARG STREAM=overridden
ARG MUTATE_OS_RELEASE=overridden
ARG MANIFEST=overridden
ARG IMAGE_CONFIG=overridden
# XXX: see inject_passwd_group() in build-rootfs
ARG PASSWD_GROUP_DIR
ARG STRICT_MODE=0
ARG INJECT_OPENSHIFT_VERSION_LABELS=""
ARG BUILDER_IMG_CHUNKER=""
ARG BUILDER_IMG_CHUNKER_MAX_LAYERS=""

COPY . /src
# canonicalize permission bits, see also https://gitlab.com/fedora/bootc/base-images/-/merge_requests/274
RUN chmod -R a=rX,u+w /src

# useful if you're hacking on rpm-ostree/bootc-base-imagectl
# COPY rpm-ostree /usr/bin/
# COPY bootc-base-imagectl /usr/libexec/

# always nuke any leftover libdnf lockfile from interrupted runs
RUN --mount=type=cache,rw,id=coreos-build-cache,target=/cache \
        rm -rf /cache/cache/*lock*
RUN --mount=type=cache,rw,id=coreos-build-cache,target=/cache \
    --mount=type=secret,id=container-image-build/yumrepos,target=/run/secrets/yumrepos \
    --mount=type=secret,id=container-image-build/contentsets \
        /src/build-rootfs --srcdir=/src make-rootfs --target-rootfs /target-rootfs
# Take the rootfs and created a chunked container out of it
RUN --mount=type=bind,target=/run/src,rw <<EOF
    set -eux -o pipefail
    EXTRA_ARGS=()
    if [ -n "${INJECT_OPENSHIFT_VERSION_LABELS}" ]; then
        EXTRA_ARGS+=(--label "io.openshift.build.versions=machine-os=${VERSION}")
        EXTRA_ARGS+=(--label "io.openshift.build.version-display-names=machine-os=${DESCRIPTION}")
    fi
    case "${BUILDER_IMG_CHUNKER:-}" in
        'chunkah')
            # The '--prune /sysroot/ --label ostree.commit- --label ostree.final-diffid-'
            # will strip OSTree data and labels for bootc compatibility; see
            # https://github.com/coreos/chunkah#compatibility-with-bootable-bootc-images
            chunkah build --rootfs /target-rootfs                                                             \
                --prune /sysroot/ --label ostree.commit- --label ostree.final-diffid-                         \
                --output oci-archive:/run/src/out.ociarchive                                                  \
                --label com.coreos.inputhash=$(cat /run/inputhash)                                            \
                ${BUILDER_IMG_CHUNKER_MAX_LAYERS:+--max-layers=${BUILDER_IMG_CHUNKER_MAX_LAYERS}}             \
                "${EXTRA_ARGS[@]}"
            ;;
        "")
            rpm-ostree experimental compose build-chunked-oci                                                 \
                --bootc --format-version=1 --rootfs /target-rootfs                                            \
                --output oci-archive:/run/src/out.ociarchive                                                  \
                --label com.coreos.inputhash=$(cat /run/inputhash)                                            \
                "${EXTRA_ARGS[@]}"
            ;;
        *)
            echo "error: unknown BUILDER_IMG_CHUNKER value: ${BUILDER_IMG_CHUNKER}" >&2
            exit 1
            ;;
    esac
EOF

FROM oci-archive:./out.ociarchive
ARG VERSION
ARG NAME=overridden
ARG STREAM=overridden
ARG DESCRIPTION=overridden
ARG MAINTAINER=overridden
ARG VENDOR=overridden
ARG URL=overridden
ARG DISTRIBUTION_SCOPE=overridden
ARG COMPONENT=overridden
ARG CPE_NAME=overridden
# Need to reference builder here to force ordering. But since we have to run
# something anyway, we might as well cleanup after ourselves.
RUN --mount=type=bind,from=builder,target=/var/tmp \
    --mount=type=bind,target=/run/src,rw \
      rm /run/src/out.ociarchive

LABEL containers.bootc=1 \
      ostree.bootable=1 \
      org.opencontainers.image.version=$VERSION \
      com.coreos.osname=$NAME \
      name=$NAME \
      com.coreos.stream=$STREAM \
      org.opencontainers.image.title=$DESCRIPTION \
      org.opencontainers.image.description=$DESCRIPTION \
      io.k8s.description=$DESCRIPTION \
      description=$DESCRIPTION \
      maintainer=$MAINTAINER \
      vendor=$VENDOR \
      url=$URL \
      distribution-scope=$DISTRIBUTION_SCOPE \
      com.redhat.component=$COMPONENT \
      cpe=$CPE_NAME
STOPSIGNAL SIGRTMIN+3
CMD ["/sbin/init"]