# Base image. CI passes BASE_IMAGE=almalinux/9-base@sha256:<digest>, resolved
# DIRECTLY from Docker Hub in the same run (.gitea/scripts/resolve-base-image.sh),
# so the pkg-cache registry mirror can only serve content-addressed blobs.
# Local builds use the tag.
ARG BASE_IMAGE=almalinux/9-base
FROM ${BASE_IMAGE}

# OPTIONAL internal package cache, e.g. --build-arg PKG_CACHE=https://192.168.1.40
# (CT130 pkg-cache, https only). Unset = upstream repositories. epel-release is
# GPG-verified against keys/pkg-cache/ either way. Repo files are restored at
# the end of the RUN, so no layer keeps the cache address. Same script as
# cloud-apache-container (scripts/pkg-cache-repos.sh, docs/pkg-cache.md there).
ARG PKG_CACHE=
COPY ./scripts/pkg-cache-repos.sh /usr/local/sbin/pkg-cache-repos.sh
COPY ./keys/pkg-cache/ /usr/local/share/pkg-cache/
RUN /usr/local/sbin/pkg-cache-repos.sh rpm && \
    /usr/local/sbin/pkg-cache-repos.sh release-install epel && \
    /usr/local/sbin/pkg-cache-repos.sh rpm && \
    dnf update -y && \
    dnf install -y memcached procps-ng && \
    /usr/local/sbin/pkg-cache-repos.sh restore && \
    dnf clean all && \
    rm -rf /var/cache/dnf /var/cache/yum
COPY ./scripts/entrypoint.sh /
RUN chmod +x /entrypoint.sh
ENTRYPOINT [ "/entrypoint.sh" ]