# boco runner: compiles boco (static musl) AND the shared boco kernel (vmlinuz)
# with the slim config checked into the boco repo, then serves as the runtime
# image for `boco build` / `boco boot` under podman.
#
# Runtime requirements (boco shells out to nested rootless podman):
#   --device /dev/kvm      KVM accel for the VMs (entrypoint chmods it)
#   --device /dev/net/tun  only if nested container runs need pasta networking
#   volume at /home/boco/.local/share/boco   persistent registry (images+kernel)
#   NO --privileged: the container's own userns (single mapping) is what makes
#   nested `podman unshare` work; ignore_chown_errors handles unmapped uids.
#
# Kernel source: pinned tarball linux-7.2 (= 8d3ae59288f1e7d58d76558a6ee96d533bc5019f,
# verified == refs/tags/v7.2{} via git ls-remote), sha256-checked.

FROM alpine:edge AS build
RUN apk add --no-cache rust cargo git
WORKDIR /src
COPY . .
# alpine's rust targets x86_64-alpine-linux-musl natively (static, no glibc dep)
RUN cargo build --release -p boco -p boco-init \
 && strip target/release/boco target/release/boco-init

FROM alpine:3.22 AS kernel
# g++ for host tools, libelf for objtool, openssl for extract-cert
RUN apk add --no-cache make gcc g++ musl-dev perl flex bison bc \
      elfutils-dev openssl-dev findutils tar xz zstd curl linux-headers diffutils
WORKDIR /kbuild
# Pinned upstream tarball: linux-7.2.tar.xz, sha256
# f9fef3d14c0df53819026f4be74459835c2a0b0dcbf5b5bbd9ea19f0829402b3.
# (Equivalent to the upstream shallow pin 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
# = refs/tags/v7.2{} — verified via `git ls-remote`; the tarball avoids
# a multi-GB shallow clone through flaky slirp NAT.)
RUN curl -fsSLo /tmp/linux-7.2.tar.xz https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.xz \
 && echo "f9fef3d14c0df53819026f4be74459835c2a0b0dcbf5b5bbd9ea19f0829402b3  /tmp/linux-7.2.tar.xz" | sha256sum -c - \
 && tar -xJf /tmp/linux-7.2.tar.xz \
 && mv linux-7.2 linux
# Install the slim kernel config checked into the boco repo; olddefconfig
# normalizes it against this tree and fails nothing silently afterwards.
COPY kernel/config /kbuild/linux/.config
RUN make -C linux olddefconfig HOSTCC=gcc CC=gcc \
 && grep -qE '^(# )?CONFIG_MODULES' linux/.config
RUN make -C linux -j"$(nproc)" bzImage HOSTCC=gcc CC=gcc \
 && cp linux/arch/x86/boot/bzImage /vmlinuz \
 && ls -lh /vmlinuz

FROM alpine:3.22
RUN apk add --no-cache \
      qemu-system-x86_64 qemu-img virtiofsd \
      podman fuse3 openssh-client ca-certificates iptables ip6tables \
      e2fsprogs cpio passt \
 && adduser -D -s /bin/sh boco \
 && echo boco:100000:65536 > /etc/subuid \
 && echo boco:100000:65536 > /etc/subgid \
 && mkdir -p /etc/containers \
 && printf '[storage]\ndriver = "vfs"\nrunroot = "/run/containers/storage"\ngraphroot = "/var/lib/containers/storage"\n[storage.options]\nignore_chown_errors = "true"\n' > /etc/containers/storage.conf \
 && printf '#!/bin/sh\n[ -e /dev/kvm ] && chmod 666 /dev/kvm\nexec /usr/local/bin/boco "$@"\n' > /usr/local/bin/entrypoint.sh \
 && chmod 755 /usr/local/bin/entrypoint.sh
COPY --from=build /src/target/release/boco /usr/local/bin/boco
COPY --from=build /src/target/release/boco-init /home/boco/.local/share/boco/boco-init
COPY --from=kernel /vmlinuz /home/boco/.local/share/boco/vmlinuz
RUN chmod 755 /usr/local/bin/boco /home/boco/.local/share/boco/boco-init /home/boco/.local/share/boco/vmlinuz
ENV XDG_DATA_HOME=/home/boco/.local/share
WORKDIR /data
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
CMD ["image", "list"]