## Cave — local dev container (uses pre-built binaries)
##
## Build:  make && podman build -t cave -f Containerfile.local .
## Run:    podman run -d --name cave -p 8080:8080 -p 2222:22 cave:latest

FROM golang:1.25-alpine AS landrun-builder

## landrun: Landlock sandbox CLI used by SANDBOX-WRAP (src/git.lisp) to confine
## git + check subprocesses (filesystem MAC). Built from the pinned v0.1.14
## release WITH our REFER fix (upstream issue #48 / PR #49): stock landrun calls
## RestrictPaths + RestrictNet separately, stacking two Landlock rulesets so the
## kernel denies ACCESS_FS_REFER and receive-pack's quarantine migration fails
## with EXDEV. The patch applies all rules in one ruleset. Once upstream merges
## the fix, drop the patch and switch to `go install ...@<release>`.
RUN apk add --no-cache git
COPY contrib/landrun/0001-refer-single-ruleset.patch /tmp/landrun-refer.patch
RUN git clone --depth 1 --branch v0.1.14 https://github.com/Zouuup/landrun.git /build/landrun \
 && cd /build/landrun \
 && git apply /tmp/landrun-refer.patch \
 && CGO_ENABLED=0 go build -o /usr/local/bin/landrun ./cmd/landrun

FROM fedora:42

RUN dnf install -y openssh-server git openssl gnupg2 && dnf clean all && \
    useradd -m -s /bin/bash cave && \
    mkdir -p /etc/ssh && \
    ssh-keygen -A && \
    sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config && \
    sed -i 's/#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config && \
    mkdir -p /etc/ssh/sshd_config.d && \
    printf 'ClientAliveInterval 15\nClientAliveCountMax 8\nTCPKeepAlive yes\n' > /etc/ssh/sshd_config.d/10-keepalive.conf && \
    mkdir -p /var/lib/cave/repos /var/lib/cave/tmp /data/zoekt-index && \
    chown -R cave:cave /var/lib/cave /data/zoekt-index && \
    mkdir -p /home/cave/.ssh && \
    chmod 700 /home/cave/.ssh && \
    chown cave:cave /home/cave/.ssh

COPY cave-server /usr/bin/cave-server
COPY cave /usr/bin/cave
COPY zoekt-git-index /usr/local/bin/zoekt-git-index
COPY cave-shell.sh /usr/bin/cave-shell.sh
COPY --from=landrun-builder /usr/local/bin/landrun /usr/local/bin/landrun
COPY static/ /opt/cave/static/
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh /usr/bin/cave-server /usr/bin/cave /usr/bin/cave-shell.sh /usr/local/bin/landrun

EXPOSE 8080 22
VOLUME /var/lib/cave
ENTRYPOINT ["/entrypoint.sh"]