# syntax=docker/dockerfile:1.12
# Scratch-derived, linux/amd64 only. Freeze by registry manifest digest after validation.
FROM registry.access.redhat.com/ubi10/ubi-minimal@sha256:afbfb5c18c628796fed3ad3122dcf096e0b2dec9dad3fbabe8620de06bc6f078
LABEL io.itworx.contextforge.os-base.role="runtime" \
      io.itworx.contextforge.os-base.upstream-commit="1e58a0434a78bbdbe1e975abeb0bed1043ff14c1" \
      io.itworx.contextforge.os-base.upstream-containerfile-sha256="2ab0187f3a63eced093a1dec3141ec3e30ef879eb7de0dfd9e4bc5fce33f64f2" \
      io.itworx.contextforge.os-base.parent-ref="registry.access.redhat.com/ubi10/ubi-minimal@sha256:afbfb5c18c628796fed3ad3122dcf096e0b2dec9dad3fbabe8620de06bc6f078" \
      io.itworx.contextforge.os-base.platform="linux/amd64"

RUN microdnf upgrade -y --nodocs --setopt=install_weak_deps=0 \
    && microdnf install -y --nodocs --setopt=install_weak_deps=0 \
        python3.12 \
        ca-certificates \
        procps-ng \
        shadow-utils \
        libpq \
    && microdnf clean all \
    && rm -rf /var/cache/yum \
    && ln -sf /usr/bin/python3.12 /usr/bin/python3 \
    && groupadd --gid 10001 app \
    && useradd --uid 10001 --gid 10001 --home-dir /app --shell /sbin/nologin --no-create-home --comment app app

RUN set -eu \
    && mkdir -p /usr/share/itworx \
    && rpm -qa --qf '%{NAME}|%{EPOCHNUM}|%{VERSION}|%{RELEASE}|%{ARCH}\n' > /tmp/itworx-rpm-inventory.unsorted \
    && LC_ALL=C sort /tmp/itworx-rpm-inventory.unsorted > /usr/share/itworx/rpm-inventory.txt \
    && rm /tmp/itworx-rpm-inventory.unsorted \
    && chmod 0444 /usr/share/itworx/rpm-inventory.txt