FROM dhi.io/debian-base:trixie-debian13-dev AS build
LABEL maintainer="Penpot <docker@penpot.app>"

ENV LANG='C.UTF-8' \
    LC_ALL='C.UTF-8' \
    JAVA_HOME="/opt/jdk" \
    DEBIAN_FRONTEND=noninteractive \
    TZ=Etc/UTC

RUN set -ex; \
    apt-get -qq update; \
    apt-get -qq dist-upgrade; \
    apt-get -qqy --no-install-recommends install \
        binutils \
        ca-certificates \
        curl \
    ; \
    apt-get clean; \
    rm -rf /var/lib/apt/lists/*

RUN set -eux; \
    ARCH="$(dpkg --print-architecture)"; \
    case "${ARCH}" in \
       aarch64|arm64) \
         ESUM='5b222fce0b7076a10ac7ae3b1009a6c2caf4f35bc4e81de72010af6750c5e146'; \
         BINARY_URL='https://cdn.azul.com/zulu/bin/zulu26.32.13-ca-jdk26.0.2-linux_aarch64.tar.gz'; \
         ;; \
       amd64|x86_64) \
         ESUM='4b7c114917aebd0fc6284fc7111245d7747a4d9603bd12d86b384b1abc9d575d'; \
         BINARY_URL='https://cdn.azul.com/zulu/bin/zulu26.32.13-ca-jdk26.0.2-linux_x64.tar.gz'; \
         ;; \
       *) \
         echo "Unsupported arch: ${ARCH}"; \
         exit 1; \
         ;; \
    esac; \
    curl -LfsSo /tmp/openjdk.tar.gz ${BINARY_URL}; \
    echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
    mkdir -p /opt/jdk; \
    cd /opt/jdk; \
    tar -xf /tmp/openjdk.tar.gz --strip-components=1; \
    rm -rf /tmp/openjdk.tar.gz; \
    /opt/jdk/bin/jlink \
       --no-header-files \
       --no-man-pages \
       --strip-debug \
       --add-modules java.base,jdk.net,jdk.management.agent,java.se,jdk.compiler,jdk.javadoc,jdk.attach,jdk.unsupported,jdk.jfr,jdk.jcmd \
       --output /opt/jre;


FROM dhi.io/debian-base:trixie-debian13-dev AS image
LABEL maintainer="Penpot <docker@penpot.app>"

ENV LANG='C.UTF-8' \
    LC_ALL='C.UTF-8' \
    JAVA_HOME="/opt/jre" \
    PATH=/opt/jre/bin:/opt/imagick/bin:$PATH \
    DEBIAN_FRONTEND=noninteractive \
    TZ=Etc/UTC \
    LD_LIBRARY_PATH=/opt/imagick/lib/deps

RUN set -ex; \
    apt-get -qq update; \
    apt-get -qqy --no-install-recommends install passwd; \
    useradd -U -M -u 1001 -s /bin/false -d /opt/penpot penpot; \
    apt-get -qq dist-upgrade; \
    apt-get -qqy --no-install-recommends install \
        ca-certificates \
        curl \
        fontconfig \
        fontforge \
        libfontconfig1 \
        libfreetype6 \
        libglib2.0-0 \
        libgomp1 \
        libheif1 \
        libjpeg62-turbo \
        liblcms2-2 \
        libopenexr-3-1-30 \
        libopenjp2-7 \
        libpng16-16 \
        librsvg2-2 \
        libtiff6 \
        libwebp7 \
        libwebpdemux2 \
        libwebpmux3 \
        libxml2 \
        libzip5 \
        libzstd1 \
        python3 \
        python3-tabulate \
        tzdata \
        woff-tools \
        woff2 \
    ; \
    find tmp/usr/share/zoneinfo/* -type d ! -name 'Etc' |xargs rm -rf; \
    apt-get clean; \
    rm -rf /var/lib /var/cache; \
    rm -rf /usr/include; \
    mkdir -p /opt/data/assets; \
    mkdir -p /opt/penpot; \
    chown -R penpot:penpot /opt/penpot; \
    chown -R penpot:penpot /opt/data;

COPY --from=build /opt/jre /opt/jre
COPY --from=penpotapp/imagemagick:7.1.2-27 /opt/imagick /opt/imagick

COPY files/imagemagick-policy.xml /opt/imagick/etc/ImageMagick-7/policy.xml

ARG BUNDLE_PATH="./bundle-backend/"
COPY --chown=penpot:penpot $BUNDLE_PATH /opt/penpot/backend/

USER penpot:penpot
WORKDIR /opt/penpot/backend
CMD ["/bin/bash", "run.sh"]