Dockerfile.tmpl

########
# Base #
########

FROM debian:bookworm-slim

ARG DEBIAN_FRONTEND="noninteractive"

ARG MANALA_USER_ID="1000"
ARG MANALA_GROUP_ID="1000"

ARG GOMPLATE_VERSION="3.11.7"
ARG DIRENV_VERSION="2.33.0"

# The 'container' environment variable tells systemd that it's running inside a
# Docker container environment.
# It's also internally used for checking we're running inside a container.
ENV container="docker"

# Default locale
ENV LANG C.UTF-8

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

RUN \
    apt-get --quiet update \
    && apt-get --quiet --yes --purge --autoremove upgrade \
    && apt-get --quiet --yes --no-install-recommends --verbose-versions install \
        s6 \
        sudo \
        curl \
        ca-certificates \
        gnupg \
        libarchive-tools bzip2 \
        bash-completion \
        rsync \
        git \
        make \
        less \
        vim \
        socat \
    # User
    && addgroup --gid ${MANALA_GROUP_ID} lazy \
    && adduser --home /home/lazy --shell /bin/bash --uid ${MANALA_USER_ID} --gecos lazy --ingroup lazy --disabled-password lazy \
    && install --verbose --mode 0755 --group lazy --owner lazy --directory /run/user/${MANALA_USER_ID} \
    && echo "lazy ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/lazy \
    # Gomplate
    && curl -sSL "https://github.com/hairyhenderson/gomplate/releases/download/v${GOMPLATE_VERSION}/gomplate_linux-{{ include "arch_map" (dict "amd64" "amd64" "arm64" "arm64") }}" \
        --output /usr/local/bin/gomplate \
    && chmod +x /usr/local/bin/gomplate \
    # Direnv
    && curl -sSL "https://github.com/direnv/direnv/releases/download/v${DIRENV_VERSION}/direnv.linux-{{ include "arch_map" (dict "amd64" "amd64" "arm64" "arm64") }}" \
        --output /usr/local/bin/direnv \
    && chmod +x /usr/local/bin/direnv \
    # Bash completion
    && install --verbose --mode 0755 --directory /etc/bash_completion.d \
    # Oh My Bash
    && git clone https://github.com/ohmybash/oh-my-bash.git /usr/local/share/oh-my-bash \
    # Clean
    && rm -rf /var/lib/apt/lists/*

##########
# System #
##########

ENV PIPX_HOME="/usr/local/pipx"
ENV PIPX_BIN_DIR="/usr/local/bin"

{{ $apt := .Vars.system.apt -}}

RUN \
    apt-get --quiet update \
    && apt-get --quiet --yes --no-install-recommends --verbose-versions install \
        openssh-client \
        sshpass \
        python3 \
        pipx \
        python3-argcomplete \
        shellcheck \
        {{- range $package := $apt.packages }}
        {{ $package }} \
        {{- end }}
    # Sudo
    && echo "Defaults env_keep += \"PIPX_*\"" > /etc/sudoers.d/pipx \
    # Bash completion
    && activate-global-python-argcomplete --dest /etc/bash_completion.d \
    # Clean
    && rm -rf /var/lib/apt/lists/*

{{ if .Vars.system.docker -}}
# Docker
RUN \
    curl -sSL https://download.docker.com/linux/debian/gpg \
        --output /etc/apt/keyrings/docker.asc \
    && printf "\
Types: deb\n\
URIs: https://download.docker.com/linux/debian\n\
Suites: {{ include "os_release" "VERSION_CODENAME" }}\n\
Components: stable\n\
Signed-By: /etc/apt/keyrings/docker.asc\n\
" > /etc/apt/sources.list.d/docker.sources \
    && apt-get --quiet update \
    && apt-get --quiet --yes --no-install-recommends --verbose-versions install \
        docker-ce-cli \
    # Clean
    && rm -rf /var/lib/apt/lists/*

{{ end -}}

{{ $goss := .Vars.system.goss -}}
{{ if $goss.version -}}
# Goss
RUN \
    curl -sSL "https://github.com/goss-org/goss/releases/download/v{{ $goss.version }}/goss-linux-{{ include "arch_map" (dict "amd64" "amd64" "arm64" "arm64") }}" \
        --output /usr/local/bin/goss \
    && chmod +x /usr/local/bin/goss

{{ end -}}

{{ $ansible := .Vars.system.ansible -}}
# Ansible
RUN \
    pipx install --pip-args="--no-cache-dir" \
        ansible-core=={{ $ansible.version }}
    {{- if $ansible.dependencies }} \
    && pipx inject --pip-args="--no-cache-dir" ansible-core \
        {{- range $i, $dependency := $ansible.dependencies }}
        {{- if $i }} \{{- end }}
        {{ $dependency }}
        {{- end }}
    {{- end }}

{{ $ansibleLint := index .Vars.system "ansible-lint" -}}
{{ if $ansibleLint.version -}}
# Ansible Lint
RUN \
    BUILD_PACKAGES=( \
        libpython3-dev gcc \
    ) \
    && apt-get --quiet update \
    && apt-get --quiet --yes --no-install-recommends --verbose-versions install \
        "${BUILD_PACKAGES[@]}" \
    && pipx install --pip-args="--no-cache-dir" \
        ansible-lint=={{ $ansibleLint.version }} \
    {{- if $ansibleLint.dependencies }}
    && pipx inject --pip-args="--no-cache-dir" ansible-lint \
        {{- range $dependency := $ansibleLint.dependencies }}
        {{ $dependency }} \
        {{- end }}
    {{- end }}
    # Clean
    && apt-get --quiet --yes --autoremove purge \
        "${BUILD_PACKAGES[@]}" \
    && rm -rf /var/lib/apt/lists/*

{{ end -}}

{{ $molecule := .Vars.system.molecule -}}
{{ if $molecule.version -}}
# Molecule
RUN \
    pipx install --pip-args="--no-cache-dir" \
        molecule=={{ $molecule.version }} \
    && _MOLECULE_COMPLETE=bash_source molecule > /etc/bash_completion.d/molecule \
    {{- if $molecule.dependencies }}
    && pipx inject --pip-args="--no-cache-dir" molecule \
        {{- range $i, $dependency := $molecule.dependencies }}
        {{- if $i }} \{{- end }}
        {{ $dependency }}
        {{- end }}
    {{- end }}

{{ end -}}

{{ $terraform := .Vars.system.terraform -}}
{{ if $terraform.version -}}
# Terraform
RUN \
    curl -sSL "https://releases.hashicorp.com/terraform/{{ $terraform.version }}/terraform_{{ $terraform.version }}_linux_{{ include "arch_map" (dict "amd64" "amd64" "arm64" "arm64") }}.zip" \
        | bsdtar -xvf - -C /usr/local/bin \
    && chmod +x /usr/local/bin/terraform \
    # Bash completion
    && echo "complete -C /usr/local/bin/terraform terraform" > /etc/bash_completion.d/terraform \
    # Bash aliases
    && printf "alias tf='terraform'\n\
complete -C /usr/local/bin/terraform tf\n\
" > /etc/profile.d/terraform.sh

{{ end -}}

# Run
COPY docker/entrypoint.sh /
ENTRYPOINT ["/entrypoint.sh"]
CMD ["bash"]