# =============================================================================
# pgpipe — minimal Docker image
# =============================================================================
# Pulls the published pgpipe binary from pghorizon.com and ships it inside a
# small Alpine image. No source code or Go toolchain required.
#
# Build (current host architecture):
#   docker build -t pgpipe:4.0.0 .
#
# Build a different version:
#   docker build --build-arg PGPIPE_VERSION=4.0.0 -t pgpipe:4.0.0 .
#
# Multi-arch build (amd64 + arm64) — requires buildx:
#   docker buildx build --platform linux/amd64,linux/arm64 -t pgpipe:4.0.0 .
#
# Run:
#   docker run --rm -p 8080:8080 \
#     --read-only --tmpfs /tmp:rw,noexec,nosuid,size=64m \
#     -v "$(pwd)/pgpipe.yaml:/etc/pgpipe/pgpipe.yaml:ro" \
#     -v pgpipe-state:/var/lib/pgpipe \
#     pgpipe:4.0.0
# =============================================================================

FROM alpine:3.23@sha256:fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40

ARG PGPIPE_VERSION=4.0.0
# TARGETARCH is set automatically by Docker buildx (amd64 / arm64 / arm / 386).
ARG TARGETARCH=amd64

LABEL org.opencontainers.image.title="pgpipe"
LABEL org.opencontainers.image.description="PostgreSQL change-data-capture pipeline"
LABEL org.opencontainers.image.version="${PGPIPE_VERSION}"
LABEL org.opencontainers.image.url="https://www.pghorizon.com/pgpipe/"
LABEL org.opencontainers.image.source="https://www.pghorizon.com/downloads/pgpipe/"
LABEL org.opencontainers.image.vendor="PG Horizon Limited"
LABEL org.opencontainers.image.licenses="LicenseRef-Proprietary"

RUN apk add --no-cache ca-certificates tzdata curl \
 && curl -fsSL "https://www.pghorizon.com/downloads/pgpipe/v${PGPIPE_VERSION}/pgpipe-linux-${TARGETARCH}" \
        -o /usr/local/bin/pgpipe \
 && curl -fsSL "https://www.pghorizon.com/downloads/pgpipe/v${PGPIPE_VERSION}/checksums.txt" \
        -o /tmp/checksums.txt \
 && (cd /usr/local/bin && \
     grep "pgpipe-linux-${TARGETARCH}\$" /tmp/checksums.txt | \
     awk -v f=pgpipe '{print $1"  "f}' | sha256sum -c -) \
 && rm /tmp/checksums.txt \
 && chown root:root /usr/local/bin/pgpipe \
 && chmod 0555 /usr/local/bin/pgpipe \
 && apk del curl \
 && addgroup -S -g 10001 pgpipe \
 && adduser -S -D -H -u 10001 -h /var/lib/pgpipe -s /sbin/nologin -G pgpipe pgpipe \
 && install -d -m 0550 -o root -g pgpipe /etc/pgpipe \
 && install -d -m 0750 -o pgpipe -g pgpipe /var/lib/pgpipe

# Bound Go heap growth so GC runs under memory pressure rather than
# only when the live heap doubles. Override at run time if you have a
# larger host: docker run -e GOMEMLIMIT=6GiB ...
ENV GOMEMLIMIT=2GiB \
    HOME=/var/lib/pgpipe

USER 10001:10001
WORKDIR /var/lib/pgpipe

EXPOSE 8080

# Native healthcheck handles HTTP, HTTPS, and intentionally headless pipelines.
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
  CMD ["pgpipe", "healthcheck", "--config", "/etc/pgpipe/pgpipe.yaml", "--timeout", "3s", "--allow-disabled-server"]

ENTRYPOINT ["pgpipe"]
CMD ["start", "--config", "/etc/pgpipe/pgpipe.yaml"]