FROM alpine:3.23@sha256:85fe1e81d6758c208f3e1eed4338a1997e19d4be002d4dd32d3100c9a8c010a0 AS verified-binaries
COPY binaries/ /binaries/
ARG TARGETARCH
RUN cd /binaries && sha256sum -c checksums.txt && \
    case "$TARGETARCH" in amd64|arm64) ;; *) exit 1 ;; esac && \
    cp "pgpipe-linux-$TARGETARCH" /pgpipe && \
    cp "pgpipe-demo-bootstrap-linux-$TARGETARCH" /pgpipe-demo-bootstrap
FROM verified-binaries AS runtime-download
FROM verified-binaries AS bootstrap-download

FROM postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777 AS database
COPY --chmod=0555 volume-guard.sh database-entrypoint.sh /usr/local/share/pgpipe-quickstart/
COPY --chmod=0555 database-ready.sh /docker-entrypoint-initdb.d/99-ready.sh
ENV PGDATA=/var/lib/postgresql/data/data
ENTRYPOINT ["/usr/local/share/pgpipe-quickstart/database-entrypoint.sh"]
CMD ["postgres"]

FROM database AS source
COPY source.sql /docker-entrypoint-initdb.d/10-source.sql

FROM database AS destination
COPY --chown=root:root --chmod=0644 THIRD_PARTY_LICENSES.txt /usr/share/doc/pgpipe/THIRD_PARTY_LICENSES.txt
RUN test -s /usr/share/doc/pgpipe/THIRD_PARTY_LICENSES.txt && \
    install -d -m 0755 -o root -g root /usr/share/doc/pgpipe
COPY --from=bootstrap-download --chmod=0555 /pgpipe-demo-bootstrap /usr/local/bin/pgpipe-demo-bootstrap
COPY destination.sql /docker-entrypoint-initdb.d/10-destination.sql
COPY --chmod=0555 destination-bootstrap.sh /docker-entrypoint-initdb.d/20-protected-storage.sh

FROM alpine:3.23@sha256:85fe1e81d6758c208f3e1eed4338a1997e19d4be002d4dd32d3100c9a8c010a0 AS config-init
COPY --chmod=0555 volume-guard.sh config-init.sh /setup/
COPY pgpipe.yaml /seed/pgpipe.yaml
ENTRYPOINT ["/setup/config-init.sh"]

# The default image contains no bootstrap helper or destination administrator binding.
FROM alpine:3.23@sha256:85fe1e81d6758c208f3e1eed4338a1997e19d4be002d4dd32d3100c9a8c010a0 AS runtime
COPY --chown=root:root --chmod=0644 THIRD_PARTY_LICENSES.txt /usr/share/doc/pgpipe/THIRD_PARTY_LICENSES.txt
RUN test -s /usr/share/doc/pgpipe/THIRD_PARTY_LICENSES.txt && \
    install -d -m 0755 -o root -g root /usr/share/doc/pgpipe && \
    apk add --no-cache ca-certificates tzdata && \
    addgroup -S -g 10001 pgpipe && \
    adduser -S -D -H -u 10001 -h /var/lib/pgpipe/data -s /sbin/nologin -G pgpipe pgpipe && \
    mkdir -p /etc/pgpipe /var/lib/pgpipe
COPY --from=runtime-download --chmod=0555 /pgpipe /usr/local/bin/pgpipe
LABEL org.opencontainers.image.title="pgpipe" org.opencontainers.image.version="7.0.0" \
      org.opencontainers.image.licenses="LicenseRef-Proprietary"
ENV GOMEMLIMIT=2GiB HOME=/var/lib/pgpipe/data PGPIPE_DEPLOYMENT=container
USER 10001:10001
WORKDIR /var/lib/pgpipe
EXPOSE 8080
HEALTHCHECK --interval=5s --timeout=5s --start-period=20s --retries=12 \
  CMD ["pgpipe", "healthcheck", "--config", "/etc/pgpipe/data/pgpipe.yaml", "--timeout", "3s"]
ENTRYPOINT ["pgpipe"]
CMD ["start", "--config", "/etc/pgpipe/data/pgpipe.yaml"]
