Dockerfile.tmpl

########
# Base #
########

FROM debian:bookworm-slim

ARG DEBIAN_FRONTEND="noninteractive"

ARG MANALA_USER_ID="1000"
ARG MANALA_GROUP_ID="1000"

ARG GOMPLATE_VERSION="3.11.7"
ARG DIRENV_VERSION="2.33.0"

# The 'container' environment variable tells systemd that it's running inside a
# Docker container environment.
# It's also internally used for checking we're running inside a container.
ENV container="docker"

# Default locale
ENV LANG C.UTF-8

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

RUN \
    apt-get --quiet update \
    && apt-get --quiet --yes --purge --autoremove upgrade \
    && apt-get --quiet --yes --no-install-recommends --verbose-versions install \
        s6 \
        sudo \
        curl \
        ca-certificates \
        gnupg \
        libarchive-tools bzip2 \
        bash-completion \
        rsync \
        git \
        make \
        less \
        vim \
        socat \
    # User
    && addgroup --gid ${MANALA_GROUP_ID} lazy \
    && adduser --home /home/lazy --shell /bin/bash --uid ${MANALA_USER_ID} --gecos lazy --ingroup lazy --disabled-password lazy \
    && install --verbose --mode 0755 --group lazy --owner lazy --directory /run/user/${MANALA_USER_ID} \
    && echo "lazy ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/lazy \
    # Gomplate
    && curl -sSL "https://github.com/hairyhenderson/gomplate/releases/download/v${GOMPLATE_VERSION}/gomplate_linux-{{ include "arch_map" (dict "amd64" "amd64" "arm64" "arm64") }}" \
        --output /usr/local/bin/gomplate \
    && chmod +x /usr/local/bin/gomplate \
    # Direnv
    && curl -sSL "https://github.com/direnv/direnv/releases/download/v${DIRENV_VERSION}/direnv.linux-{{ include "arch_map" (dict "amd64" "amd64" "arm64" "arm64") }}" \
        --output /usr/local/bin/direnv \
    && chmod +x /usr/local/bin/direnv \
    # Bash completion
    && install --verbose --mode 0755 --directory /etc/bash_completion.d \
    # Oh My Bash
    && git clone https://github.com/ohmybash/oh-my-bash.git /usr/local/share/oh-my-bash \
    # Clean
    && rm -rf /var/lib/apt/lists/*

##########
# System #
##########

ARG PIPX_HOME="/usr/local/pipx"
ARG PIPX_BIN_DIR="/usr/local/bin"

ARG VIM_GNUPG_VERSION="2.7.1"

{{ $apt := .Vars.system.apt -}}

RUN \
    apt-get --quiet update \
    {{- if $apt.packages }}
    && apt-get --quiet --yes --no-install-recommends --verbose-versions install \
        {{- range $package := $apt.packages }}
        {{ $package }} \
        {{- end }}
    {{- end }}
    # Vim Gnupg
    && install --verbose --mode 0755 --directory /usr/share/vim/vimfiles/pack/plugins/start/vim-gnupg \
    && curl -sSL https://github.com/jamessan/vim-gnupg/releases/download/v${VIM_GNUPG_VERSION}/vim-gnupg-v${VIM_GNUPG_VERSION}.tar.gz \
        | bsdtar -xvf - -C /usr/share/vim/vimfiles/pack/plugins/start/vim-gnupg --strip-components=1 vim-gnupg-${VIM_GNUPG_VERSION} \
    && echo "let g:GPGPreferSymmetric = 1" >> /etc/vim/vimrc \
    # Clean
    && rm -rf /var/lib/apt/lists/*

{{ if .Vars.system.docker -}}
# Docker
RUN \
    curl -sSL https://download.docker.com/linux/debian/gpg \
        --output /etc/apt/keyrings/docker.asc \
    && printf "\
Types: deb\n\
URIs: https://download.docker.com/linux/debian\n\
Suites: {{ include "os_release" "VERSION_CODENAME" }}\n\
Components: stable\n\
Signed-By: /etc/apt/keyrings/docker.asc\n\
" > /etc/apt/sources.list.d/docker.sources \
    && apt-get --quiet update \
    && apt-get --quiet --yes --no-install-recommends --verbose-versions install \
        docker-ce-cli \
    # Clean
    && rm -rf /var/lib/apt/lists/*

{{ end -}}

{{ $goss := .Vars.system.goss -}}
{{ if $goss.version -}}
# Goss
RUN \
    curl -sSL "https://github.com/goss-org/goss/releases/download/v{{ $goss.version }}/goss-linux-{{ include "arch_map" (dict "amd64" "amd64" "arm64" "arm64") }}" \
        --output /usr/local/bin/goss \
    && chmod +x /usr/local/bin/goss

{{ end -}}

# Kubectl
{{ $kubectl := .Vars.system.kubectl -}}
RUN \
    curl -sSL "https://storage.googleapis.com/kubernetes-release/release/v{{ $kubectl.version }}/bin/linux/{{ include "arch_map" (dict "amd64" "amd64" "arm64" "arm64") }}/kubectl" \
        --output /usr/local/bin/kubectl \
    && chmod +x /usr/local/bin/kubectl \
    # Bash completion
    && kubectl completion bash > /etc/bash_completion.d/kubectl \
    # Bash aliases
    && printf "\
alias k='kubectl'\n\
complete -F __start_kubectl k\n\
" > /etc/profile.d/kubectl.sh

{{ $helm := .Vars.system.helm -}}
{{ if $helm.version -}}
# Helm
ENV HELM_PLUGINS="/usr/local/share/helm/plugins"
RUN \
    curl -sSL "https://get.helm.sh/helm-v{{ $helm.version }}-linux-{{ include "arch_map" (dict "amd64" "amd64" "arm64" "arm64") }}.tar.gz" \
        | bsdtar -xvf - -C /usr/local/bin --strip-components=1 "linux-{{ include "arch_map" (dict "amd64" "amd64" "arm64" "arm64") }}/helm" \
    # Bash completion
    && helm completion bash > /etc/bash_completion.d/helm \
    # Bash aliases
    && printf "\
alias h='helm'\n\
complete -F __start_helm h\n\
" > /etc/profile.d/helm.sh
    {{- if $helm.plugins }} \
    # Plugins
      {{- range $i, $plugin := $helm.plugins }}
    && helm plugin install
      {{- if hasKey $plugin "url" }} {{ $plugin.url }}{{ end -}}
      {{- if hasKey $plugin "path" }} {{ $plugin.path }}{{ end -}}
      {{- if hasKey $plugin "version" }} --version {{ $plugin.version }}{{ end -}}
      {{- if ne $i (sub (len $helm.plugins) 1) }} \{{ end -}}
      {{- end }}
    {{- end }}

{{ end -}}

{{ $helmfile := .Vars.system.helmfile -}}
{{ if $helmfile.version -}}
# Helmfile
ENV HELMFILE_UPGRADE_NOTICE_DISABLED="1"
RUN \
    curl -sSL "https://github.com/helmfile/helmfile/releases/download/v{{ $helmfile.version }}/helmfile_{{ $helmfile.version }}_linux_{{ include "arch_map" (dict "amd64" "amd64" "arm64" "arm64") }}.tar.gz" \
        | bsdtar -xvf - -C /usr/local/bin helmfile \
    # Bash completion
    && helmfile completion bash > /etc/bash_completion.d/helmfile \
    # Bash aliases
    && printf "\
alias hf='helmfile'\n\
complete -F __start_helmfile hf\n\
alias hfi='helmfile --interactive'\n\
complete -F __start_helmfile hfi\n\
" > /etc/profile.d/helmfile.sh

{{ end -}}

{{ $k9s := .Vars.system.k9s -}}
{{ if $k9s.version -}}
# K9s
RUN \
    curl -sSL "https://github.com/derailed/k9s/releases/download/v{{ $k9s.version }}/k9s_Linux_{{ include "arch_map" (dict "amd64" "amd64" "arm64" "arm64") }}.tar.gz" \
        | bsdtar -xvf - -C /usr/local/bin k9s

{{ end -}}

{{ $stern := .Vars.system.stern -}}
{{ if $stern.version -}}
# Stern
RUN \
    curl -sSL "https://github.com/stern/stern/releases/download/v{{ $stern.version }}/stern_{{ $stern.version }}_linux_{{ include "arch_map" (dict "amd64" "amd64" "arm64" "arm64") }}.tar.gz" \
        | bsdtar -xvf - -C /usr/local/bin stern \
    # Bash completion
    && stern --completion=bash > /etc/bash_completion.d/stern

{{ end -}}

{{ $kubePrompt := index .Vars.system "kube-prompt" -}}
{{ if $kubePrompt.version -}}
# Kube Prompt
RUN \
    curl -sSL "https://github.com/c-bata/kube-prompt/releases/download/v{{ $kubePrompt.version }}/kube-prompt_v{{ $kubePrompt.version }}_linux_{{ include "arch_map" (dict "amd64" "amd64" "arm64" "arm64") }}.zip" \
        | bsdtar -xvf - -C /usr/local/bin \
    && chmod +x /usr/local/bin/kube-prompt

{{ end -}}

{{ $popeye := .Vars.system.popeye -}}
{{ if $popeye.version -}}
# Popeye
RUN \
    curl -sSL "https://github.com/derailed/popeye/releases/download/v{{ $popeye.version }}/popeye_Linux_{{ include "arch_map" (dict "amd64" "x86_64" "arm64" "arm64") }}.tar.gz" \
        | bsdtar -xvf - -C /usr/local/bin popeye

{{ end -}}

{{ $knsk := .Vars.system.knsk -}}
{{ if $knsk.version -}}
# Knsk
RUN \
    curl -sSL https://github.com/thyarles/knsk/archive/refs/tags/v{{ $knsk.version }}.tar.gz \
        | bsdtar -xvf - -C /usr/local/bin --strip-components=1 knsk-{{ $knsk.version }}/knsk.sh

{{ end -}}

{{ $vault := .Vars.system.vault -}}
{{ if $vault.version -}}
# Vault
RUN \
    curl -sSL "https://releases.hashicorp.com/vault/{{ $vault.version }}/vault_{{ $vault.version }}_linux_{{ include "arch_map" (dict "amd64" "amd64" "arm64" "arm64") }}.zip" \
        | bsdtar -xvf - -C /usr/local/bin \
    && chmod +x /usr/local/bin/vault \
    # Bash completion
    && echo "complete -C /usr/local/bin/vault vault" > /etc/bash_completion.d/vault

{{ end -}}

{{ $rclone := .Vars.system.rclone -}}
{{ if $rclone.version -}}
# Rclone
RUN \
    curl -sSL "https://downloads.rclone.org/v{{ $rclone.version }}/rclone-v{{ $rclone.version }}-linux-{{ include "arch_map" (dict "amd64" "amd64" "arm64" "arm64") }}.zip" \
        | bsdtar -xvf - -C /usr/local/bin --strip-components=1 "rclone-v{{ $rclone.version }}-linux-{{ include "arch_map" (dict "amd64" "amd64" "arm64" "arm64") }}/rclone" \
    && chmod +x /usr/local/bin/rclone \
    # Bash completion
    && rclone genautocomplete bash /etc/bash_completion.d/rclone

{{ end -}}

{{ $openstack := .Vars.system.openstack -}}
{{ if $openstack.version -}}
# Openstack
RUN \
    BUILD_PACKAGES=( \
        pipx \
        libpython3-dev gcc \
     ) \
    && apt-get --quiet update \
    && apt-get --quiet --yes --no-install-recommends --verbose-versions install \
        python3 \
        "${BUILD_PACKAGES[@]}" \
    && pipx install \
        python-openstackclient=={{ $openstack.version }} \
    # Bash completion
    && openstack complete > /etc/bash_completion.d/openstack \
    # Clean
    && apt-get --quiet --yes --autoremove purge \
        "${BUILD_PACKAGES[@]}" \
    && rm -rf /var/lib/apt/lists/*

{{ end -}}

{{ $swift := .Vars.system.swift -}}
{{ if $swift.version -}}
# Swift
RUN \
    BUILD_PACKAGES=( \
        pipx \
        libpython3-dev gcc \
    ) \
    && apt-get --quiet update \
    && apt-get --quiet --yes --no-install-recommends --verbose-versions install \
        python3 \
        "${BUILD_PACKAGES[@]}" \
    && pipx install \
        python-swiftclient=={{ $swift.version }} \
    {{ if $swift.keystone.version -}}
    && pipx inject python-swiftclient \
        python-keystoneclient=={{ $swift.keystone.version }} \
    {{ end -}}
    # Clean
    && apt-get --quiet --yes --autoremove purge \
        "${BUILD_PACKAGES[@]}" \
    && rm -rf /var/lib/apt/lists/*

{{ end -}}

{{ $scw := .Vars.system.scw -}}
{{ if $scw.version -}}
# Scaleway cli
RUN \
    curl -sSL "https://github.com/scaleway/scaleway-cli/releases/download/v{{ $scw.version }}/scaleway-cli_{{ $scw.version }}_linux_{{ include "arch_map" (dict "amd64" "amd64" "arm64" "arm64") }}" \
        --output /usr/local/bin/scw \
    && chmod +x /usr/local/bin/scw \
    # Bash completion
    && scw autocomplete script shell=/bin/bash > /etc/bash_completion.d/scw

{{ end -}}

{{ $sops := .Vars.system.sops -}}
{{ if $sops.version -}}
# Sops
RUN \
    curl -sSL "https://github.com/mozilla/sops/releases/download/v{{ $sops.version }}/sops-v{{ $sops.version }}.linux.{{ include "arch_map" (dict "amd64" "amd64" "arm64" "arm64") }}" \
        --output /usr/local/bin/sops \
    && chmod +x /usr/local/bin/sops

{{ end -}}

{{ $aws := .Vars.system.aws -}}
{{ if $aws.version -}}
# AWS cli
RUN \
    apt-get --quiet update \
    && apt-get --quiet --yes --no-install-recommends --verbose-versions install \
        groff \
    && curl -sSL "https://awscli.amazonaws.com/awscli-exe-linux-{{ include "arch_map" (dict "amd64" "x86_64" "arm64" "aarch64") }}-{{ $aws.version }}.zip" \
        --output aws.zip \
    && bsdtar -xvf aws.zip \
    && aws/install \
        --install-dir /usr/local/aws-cli \
        --bin-dir /usr/local/bin \
    && rm -rf aws* \
    # Bash completion
    && echo "complete -C /usr/local/bin/aws_completer aws" > /etc/bash_completion.d/aws \
    # Clean
    && rm -rf /var/lib/apt/lists/*

{{ end -}}

{{ $gcloud := .Vars.system.gcloud -}}
{{ if $gcloud.version -}}
# Google Cloud cli
ENV PATH="/usr/local/google-cloud-sdk/bin:${PATH}"
ENV CLOUDSDK_CORE_DISABLE_USAGE_REPORTING="1"
ENV CLOUDSDK_COMPONENT_MANAGER_DISABLE_UPDATE_CHECK="1"
RUN \
    apt-get --quiet update \
    && apt-get --quiet --yes --no-install-recommends --verbose-versions install \
        python3 \
    && curl -sSL "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-{{ $gcloud.version }}-linux-{{ include "arch_map" (dict "amd64" "x86_64" "arm64" "arm") }}.tar.gz" \
        | bsdtar -xf - -C /usr/local \
    # Profile
    && touch /etc/profile.d/gcloud.sh \
    && /usr/local/google-cloud-sdk/install.sh \
        --rc-path /etc/profile.d/gcloud.sh \
        --command-completion true \
        --path-update true \
        {{- if $gcloud.components }}
        --additional-components {{ $gcloud.components | join " " }} \
        {{- end }}
        --quiet \
    && rm -rf /etc/profile.d/gcloud.sh.backup \
    # Clean
    && rm -rf /var/lib/apt/lists/*

{{ end -}}

# Run
COPY docker/entrypoint.sh /
ENTRYPOINT ["/entrypoint.sh"]
CMD ["bash"]