# Runtime image for zddc-server.
#
# Bundles the conversion toolchain (pandoc + chromium + bubblewrap)
# AND two wrapper scripts that shadow the real binaries on PATH.
# When zddc-server exec's "pandoc" or "chromium-browser", it hits
# /usr/local/bin/pandoc (a symlink to runtime/zddc-sandbox-exec),
# which:
#
#   1. creates a transient cgroup v2 with memory + pids caps,
#   2. drops the process into that cgroup,
#   3. wraps the real binary in a bubblewrap sandbox (private
#      namespaces, read-only /usr, fresh tmpfs at /tmp, no network),
#   4. exec's /usr/bin/<name>.
#
# zddc-server's Go code is unaware of any of this — its only contract
# is "if I exec pandoc with these args, I get pandoc behavior." The
# isolation strategy lives entirely in the image; an operator who
# wants firejail / systemd-nspawn / podman-run instead just replaces
# the wrapper script and the binary code keeps working.
#
# Used by helm charts (helm/zddc-server-prod/) as the main-container
# image. The binary is built by the chart's init container from a
# pinned git ref and copied into a shared emptyDir; the chart's
# command is /usr/local/libexec/zddc-cgroup-init /zddc/zddc-server,
# so the cgroup v2 hierarchy is delegated before zddc-server starts
# (see runtime/zddc-cgroup-init for the "no internal processes"
# constraint that requires this indirection).
#
# Build:
#   podman build -t zddc-server-runtime:latest \
#       -f zddc/runtime.Containerfile zddc/
#
# Publish (example):
#   podman tag zddc-server-runtime:latest \
#       codeberg.org/varasys/zddc-server-runtime:vYYYYMMDD
#   podman push codeberg.org/varasys/zddc-server-runtime:vYYYYMMDD
#
# Size: ≈ 1 GB unpacked (chromium dominates).
FROM docker.io/library/alpine:3

RUN apk add --no-cache \
        bubblewrap \
        pandoc-cli \
        chromium \
        font-noto \
        ca-certificates

# Wrapper scripts. zddc-cgroup-init runs at container start to
# prepare cgroup v2 subtree_control delegation; zddc-sandbox-exec
# is invoked per-conversion via the symlinks below.
COPY runtime/zddc-cgroup-init  /usr/local/libexec/zddc-cgroup-init
COPY runtime/zddc-sandbox-exec /usr/local/libexec/zddc-sandbox-exec
RUN chmod 0755 /usr/local/libexec/zddc-cgroup-init \
               /usr/local/libexec/zddc-sandbox-exec \
    && ln -s /usr/local/libexec/zddc-sandbox-exec /usr/local/bin/pandoc \
    && ln -s /usr/local/libexec/zddc-sandbox-exec /usr/local/bin/chromium-browser