# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# k3s cluster image with OpenShell Helm charts and manifests
#
# This image is based on k3s and includes:
# - Packaged OpenShell Helm chart
# - HelmChart CR for auto-deploying OpenShell
# - Custom entrypoint for DNS configuration in Docker environments
#
# Component images (openshell/server, openshell/sandbox) are
# pulled at runtime from the distribution registry rather than bundled as tarballs.
# Registry credentials are generated by the entrypoint script at container start.
#
# The helm charts are built by the docker:build:cluster mise task
# and placed in deploy/docker/.build/ before this Dockerfile is built.

# Tracked upstream vulns in rancher/k3s:v1.35.2-k3s1 (bundled Go dependencies):
#   GHSA-pwhc-rpq9-4c8w  containerd v2.1.5-k3s1 (local privesc via CRI dir perms;
#                         upstream patched in 2.1.5 -- may be scanner false positive
#                         from the -k3s1 suffix)
#   GHSA-p436-gjf2-799p  docker/cli v28.3.2 (Windows-only plugin path hijack; N/A)
#   GHSA-9h8m-3fm2-qjrq  otel/sdk v1.39.0 (macOS-only PATH hijack; N/A for Linux)
#   CVE-2024-36623       docker/docker v25.0.8 (streamformatter race condition)
# Bump K3S_VERSION when a release with updated dependencies ships.
ARG K3S_VERSION=v1.35.2-k3s1
FROM rancher/k3s:${K3S_VERSION}

# Create directories for manifests, charts, and configuration
RUN mkdir -p /var/lib/rancher/k3s/server/manifests \
             /var/lib/rancher/k3s/server/static/charts \
             /etc/rancher/k3s \
             /opt/openshell/manifests \
             /opt/openshell/charts

# Copy entrypoint script that configures DNS for Docker environments
# This script detects the host gateway IP and configures CoreDNS to use it
COPY deploy/docker/cluster-entrypoint.sh /usr/local/bin/cluster-entrypoint.sh
RUN chmod +x /usr/local/bin/cluster-entrypoint.sh

# Copy healthcheck script that verifies cluster readiness
COPY deploy/docker/cluster-healthcheck.sh /usr/local/bin/cluster-healthcheck.sh
RUN chmod +x /usr/local/bin/cluster-healthcheck.sh

# Registry credentials for pulling component images at runtime are generated
# by the entrypoint script at /etc/rancher/k3s/registries.yaml.

# Copy packaged helm charts to a staging directory that won't be
# overwritten by the /var/lib/rancher/k3s volume mount. The entrypoint
# script copies them into the k3s static charts directory at container start.
COPY deploy/docker/.build/charts/*.tgz /opt/openshell/charts/

# Copy Kubernetes manifests to a persistent location that won't be overwritten by the volume mount.
# The bootstrap code will copy these to /var/lib/rancher/k3s/server/manifests/ after cluster start.
COPY deploy/kube/manifests/*.yaml /opt/openshell/manifests/

# Use custom entrypoint that configures DNS before starting k3s
ENTRYPOINT ["/usr/local/bin/cluster-entrypoint.sh"]

HEALTHCHECK --interval=5s --timeout=5s --start-period=20s --retries=60 \
  CMD ["/usr/local/bin/cluster-healthcheck.sh"]