Dockerfile

# syntax=docker/dockerfile:1.4

##
## Base layers used to build images
##


ARG GO_TAG=1.26
ARG RUST_TAG=1.90.0
ARG DEBIAN_RELEASE=trixie

# These layers include Debian apt caches, so layers that extend `apt-base`
# should not be published. Instead, these layers should be used to provide
# cached data to individual `RUN` commands.

FROM docker.io/library/debian:${DEBIAN_RELEASE}-backports AS apt-base
RUN DEBIAN_FRONTEND=noninteractive apt-get update
RUN DEBIAN_FRONTEND=noninteractive apt-get install -y curl unzip xz-utils
COPY --link bin/scurl /usr/local/bin/

# See https://apt.llvm.org/.
FROM apt-base as apt-llvm
RUN DEBIAN_FRONTEND=noninteractive apt-get update
RUN DEBIAN_FRONTEND=noninteractive apt-get install -y gnupg2
RUN /usr/bin/curl --tlsv1.2 -fsSL https://apt.llvm.org/llvm-snapshot.gpg.key |/usr/bin/tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc

ARG DEBIAN_RELEASE
# https://docs.docker.com/reference/dockerfile#understand-how-arg-and-from-interact
# ^ declare arg to use the default value in RUN below
RUN ( echo "deb http://apt.llvm.org/${DEBIAN_RELEASE}/ llvm-toolchain-${DEBIAN_RELEASE}-22 main" \
    && echo "deb-src http://apt.llvm.org/${DEBIAN_RELEASE}/ llvm-toolchain-${DEBIAN_RELEASE}-22 main" ) > /etc/apt/sources.list.d/llvm-toolchain.list
RUN cat /etc/apt/sources.list.d/llvm-toolchain.list
RUN DEBIAN_FRONTEND=noninteractive apt-get update

##
## Scripting tools
##

# json5 transforms json
FROM apt-base AS apt-json5
RUN DEBIAN_FRONTEND=noninteractive apt-get update
RUN DEBIAN_FRONTEND=noninteractive apt-get install -y node-json5
# consumers use j5j as the interface to stripping comments from json
RUN ln -s /usr/bin/json5 /usr/local/bin/j5j

# j5j turns JSON5 into plain old JSON (i.e. to be processed by jq). Upstream
# only publishes an x86_64 release asset, so it is built from source here to
# support both architectures.
FROM docker.io/library/rust:${RUST_TAG}-slim-${DEBIAN_RELEASE} as j5j
ARG J5J_VERSION=v0.2.0 # repo=olix0r/j5j
# Built against musl so the binary is static: it is copied into scratch-based
# images and unpacked onto CI runners whose glibc is older than this builder's.
RUN target="$(uname -m)-unknown-linux-musl" ; \
    rustup target add "$target" && \
    cargo install --git https://github.com/olix0r/j5j --tag "${J5J_VERSION}" \
        --target "$target" --root /usr/local

# just runs build/test recipes. Like `make` but a bit more ergonomic.
FROM apt-base as just
ARG JUST_VERSION=1.54.0 # repo=casey/just
ARG TARGETARCH
RUN arch=$(echo "$TARGETARCH" | sed -e 's/amd64/x86_64/' -e 's/arm64/aarch64/'); \
    url="https://github.com/casey/just/releases/download/${JUST_VERSION}/just-${JUST_VERSION}-${arch}-unknown-linux-musl.tar.gz" ; \
    scurl "$url" | tar zvxf - -C /usr/local/bin just

# yq is kind of like jq, but for YAML.
FROM apt-base as yq
ARG YQ_VERSION=v4.53.3 # repo=mikefarah/yq
ARG TARGETARCH
RUN url="https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_${TARGETARCH}" ; \
    scurl -o /yq "$url" && chmod +x /yq

FROM scratch as tools-script
COPY --link --from=j5j /usr/local/bin/j5j /bin/
COPY --link --from=just /usr/local/bin/just /bin/
COPY --link --from=yq /yq /bin/
COPY --link bin/scurl /bin/

##
## Kubernetes tools
##

# helm templates kubernetes manifests.
FROM apt-base as helm
ARG HELM_VERSION=v3.21.2 # repo=helm/helm
ARG TARGETARCH
RUN url="https://get.helm.sh/helm-${HELM_VERSION}-linux-${TARGETARCH}.tar.gz" ; \
    scurl "$url" | tar xzvf - --strip-components=1 -C /usr/local/bin "linux-${TARGETARCH}/helm"


# helm-docs generates documentation from helm charts.
FROM apt-base as helm-docs
ARG HELM_DOCS_VERSION=v1.14.2 # repo=norwoodj/helm-docs
ARG TARGETARCH
RUN arch=$(echo "$TARGETARCH" | sed -e 's/amd64/x86_64/'); \
    url="https://github.com/norwoodj/helm-docs/releases/download/$HELM_DOCS_VERSION/helm-docs_${HELM_DOCS_VERSION#v}_Linux_${arch}.tar.gz" ; \
    scurl "$url" | tar xzvf - -C /usr/local/bin helm-docs

# kubectl controls kubernetes clusters.
FROM apt-base as kubectl
ARG KUBECTL_VERSION=v1.36.2 # repo=kubernetes/kubernetes
ARG TARGETARCH
RUN url="https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl" ; \
    scurl -o /usr/local/bin/kubectl "$url" && chmod +x /usr/local/bin/kubectl

# k3d runs kubernetes clusters in docker.
FROM apt-base as k3d
COPY --link --from=ghcr.io/k3d-io/k3d:5.9.0 /bin/k3d /usr/local/bin/
# just-k3d is a utility that encodes many of the common k3d commands we use.
COPY --link bin/just-k3d /usr/local/bin/
# `K3S_IMAGES_JSON` configures just-k3d so that it uses a pinned version of k3s.
# This is generated by `just sync-k3s-images` and i
ENV K3S_IMAGES_JSON=/usr/local/etc/k3s-images.json
COPY --link k3s-images.json "$K3S_IMAGES_JSON"

FROM scratch as tools-k8s
COPY --link --from=helm /usr/local/bin/helm /bin/
COPY --link --from=helm-docs /usr/local/bin/helm-docs /bin/
COPY --link --from=k3d /usr/local/bin/* /bin/
ENV K3S_IMAGES_JSON=/etc/k3s-images.json
COPY --link --from=k3d /usr/local/etc/k3s-images.json "$K3S_IMAGES_JSON"
COPY --link --from=kubectl /usr/local/bin/kubectl /bin/
COPY --link --from=docker.io/smallstep/step-cli:0.28.7 /usr/local/bin/step /bin/

FROM scratch as tools-oci
COPY --link --from=ghcr.io/sigstore/cosign/cosign:v2.6.0 /ko-app/cosign /bin/
COPY --link --from=ghcr.io/oras-project/oras:v1.3.0 /bin/oras /bin/
COPY --link --from=ghcr.io/anchore/syft:v1.33.0 /syft /bin/
COPY --link --from=ghcr.io/anchore/grype:v0.96.1 /grype /bin/

##
## Linting tools
##

# actionlint lints github actions workflows.
FROM apt-base as actionlint
ARG ACTIONLINT_VERSION=v1.7.12 # repo=rhysd/actionlint
ARG TARGETARCH
RUN url="https://github.com/rhysd/actionlint/releases/download/${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION#v}_linux_${TARGETARCH}.tar.gz" ; \
    scurl "$url" | tar xzvf - -C /usr/local/bin actionlint

# checksec checks binaries for security issues.
FROM apt-base as checksec
ARG CHECKSEC_VERSION=2.7.1 # ignore
RUN url="https://raw.githubusercontent.com/slimm609/checksec/${CHECKSEC_VERSION}/checksec" ; \
    scurl -o /usr/local/bin/checksec "$url" && chmod 755 /usr/local/bin/checksec

FROM scratch as tools-lint
COPY --link --from=actionlint /usr/local/bin/actionlint /bin/
COPY --link --from=checksec /usr/local/bin/checksec /bin/
COPY --link --from=docker.io/koalaman/shellcheck:v0.11.0 /bin/shellcheck /bin/
COPY --link bin/action-* bin/just-dev bin/just-sh /bin/

##
## Protobuf
##

FROM apt-base as protobuf
ARG PROTOC_VERSION=v35.1 # repo=protocolbuffers/protobuf
ARG TARGETARCH
# protobuf spells arm64 as `aarch_64`, with an underscore.
RUN arch=$(echo "$TARGETARCH" | sed -e 's/amd64/x86_64/' -e 's/arm64/aarch_64/'); \
    url="https://github.com/google/protobuf/releases/download/$PROTOC_VERSION/protoc-${PROTOC_VERSION#v}-linux-${arch}.zip" ; \
    cd $(mktemp -d) && \
    scurl -o protoc.zip  "$url" && \
    unzip protoc.zip bin/protoc include/** && \
    mv bin/protoc /usr/local/bin/protoc && \
    chmod +x /usr/local/bin/protoc && \
    mkdir -p /usr/local/include && \
    mv include/google /usr/local/include/

##
## Rust tools
##

# cargo-action-fmt formats `cargo build` JSON output to Github Actions annotations.
FROM apt-base as cargo-action-fmt
ARG CARGO_ACTION_FMT_VERSION=v1.0.4 # ignore
ARG TARGETARCH
RUN arch=$(echo "$TARGETARCH" | sed -e 's/amd64/x86_64/' -e 's/arm64/aarch64/'); \
    url="https://github.com/olix0r/cargo-action-fmt/releases/download/release%2F${CARGO_ACTION_FMT_VERSION}/cargo-action-fmt-${CARGO_ACTION_FMT_VERSION}-${arch}-unknown-linux-musl.tar.gz" ; \
    scurl "$url" | tar zvxf - -C /usr/local/bin cargo-action-fmt

FROM apt-base as cargo-auditable
ARG CARGO_AUDITABLE_VERSION=v0.7.5 # repo=rust-secure-code/cargo-auditable
ARG TARGETARCH
RUN arch=$(echo "$TARGETARCH" | sed -e 's/amd64/x86_64/' -e 's/arm64/aarch64/'); \
    url="https://github.com/rust-secure-code/cargo-auditable/releases/download/${CARGO_AUDITABLE_VERSION}/cargo-auditable-${arch}-unknown-linux-gnu.tar.xz" ; \
    scurl "$url" | tar xJvf - --strip-components=1 -C /usr/local/bin "cargo-auditable-${arch}-unknown-linux-gnu/cargo-auditable"

# cargo-deny checks cargo dependencies for licensing and RUSTSEC security issues.
FROM apt-base as cargo-deny
ARG CARGO_DENY_VERSION=0.19.9 # repo=EmbarkStudios/cargo-deny
ARG TARGETARCH
RUN arch=$(echo "$TARGETARCH" | sed -e 's/amd64/x86_64/' -e 's/arm64/aarch64/'); \
    url="https://github.com/EmbarkStudios/cargo-deny/releases/download/${CARGO_DENY_VERSION}/cargo-deny-${CARGO_DENY_VERSION}-${arch}-unknown-linux-musl.tar.gz" ; \
    scurl "$url" | tar zvxf - --strip-components=1 -C /usr/local/bin "cargo-deny-${CARGO_DENY_VERSION}-${arch}-unknown-linux-musl/cargo-deny"

# cargo-nextest is a nicer test runner.
FROM apt-base as cargo-nextest
ARG NEXTEST_VERSION=0.9.138 # repo=nextest-rs/nextest,prefix=cargo-nextest-
ARG TARGETARCH
RUN arch=$(echo "$TARGETARCH" | sed -e 's/amd64/x86_64/' -e 's/arm64/aarch64/'); \
    url="https://github.com/nextest-rs/nextest/releases/download/cargo-nextest-${NEXTEST_VERSION}/cargo-nextest-${NEXTEST_VERSION}-${arch}-unknown-linux-gnu.tar.gz" ; \
    scurl "$url" | tar zvxf - -C /usr/local/bin cargo-nextest

# cargo-tarpaulin is a code coverage tool.
FROM apt-base as cargo-tarpaulin
ARG CARGO_TARPAULIN_VERSION=0.35.5 # repo=xd009642/tarpaulin
ARG TARGETARCH
RUN arch=$(echo "$TARGETARCH" | sed -e 's/amd64/x86_64/' -e 's/arm64/aarch64/'); \
    url="https://github.com/xd009642/tarpaulin/releases/download/${CARGO_TARPAULIN_VERSION}/cargo-tarpaulin-${arch}-unknown-linux-musl.tar.gz" ;\
    scurl "$url" | tar xzvf - -C /usr/local/bin cargo-tarpaulin

FROM scratch as tools-rust
COPY --link --from=cargo-action-fmt /usr/local/bin/cargo-action-fmt /bin/
COPY --link --from=cargo-auditable /usr/local/bin/cargo-auditable /bin/
COPY --link --from=cargo-deny /usr/local/bin/cargo-deny /bin/
COPY --link --from=cargo-nextest /usr/local/bin/cargo-nextest /bin/
COPY --link --from=cargo-tarpaulin /usr/local/bin/cargo-tarpaulin /bin/
COPY --link bin/just-cargo /bin/

##
## Go tools
##

FROM docker.io/library/golang:${GO_TAG} as go-delve
RUN go install github.com/go-delve/delve/cmd/dlv@latest

FROM docker.io/library/golang:${GO_TAG} as go-impl
RUN go install github.com/josharian/impl@latest

FROM docker.io/library/golang:${GO_TAG} as go-outline
RUN go install github.com/ramya-rao-a/go-outline@latest

FROM docker.io/library/golang:${GO_TAG} as go-protoc
ARG PROTOC_GEN_GO_TAG=v1.36.11
ARG PROTOC_GEN_GO_GRPC_VERSION=v1.6.2
RUN go install google.golang.org/protobuf/cmd/protoc-gen-go@${PROTOC_GEN_GO_TAG}
RUN go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@${PROTOC_GEN_GO_GRPC_VERSION}

FROM docker.io/library/golang:${GO_TAG} as golangci-lint
RUN go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest

FROM docker.io/library/golang:${GO_TAG} as gomodifytags
RUN go install github.com/fatih/gomodifytags@latest

FROM docker.io/library/golang:${GO_TAG} as gopkgs
RUN go install github.com/uudashr/gopkgs/v2/cmd/gopkgs@latest

FROM docker.io/library/golang:${GO_TAG} as goplay
RUN go install github.com/haya14busa/goplay/cmd/goplay@latest

FROM docker.io/library/golang:${GO_TAG} as gopls
RUN go install golang.org/x/tools/gopls@latest

FROM docker.io/library/golang:${GO_TAG} as gotests
RUN go install github.com/cweill/gotests/gotests@latest

FROM docker.io/library/golang:${GO_TAG} as gotestsum
ARG GOTESTSUM_VERSION=v1.13.0  # repo=gotestyourself/gotestsum
RUN go install gotest.tools/gotestsum@${GOTESTSUM_VERSION}

FROM scratch as tools-go
COPY --link --from=go-delve /go/bin/dlv /bin/
COPY --link --from=go-impl /go/bin/impl /bin/
COPY --link --from=go-outline /go/bin/go-outline /bin/
COPY --link --from=go-protoc /go/bin/protoc-gen-* /bin/
COPY --link --from=golangci-lint /go/bin/golangci-lint /bin/
COPY --link --from=gomodifytags /go/bin/gomodifytags /bin/
COPY --link --from=goplay /go/bin/goplay /bin/
COPY --link --from=gopls /go/bin/gopls /bin/
COPY --link --from=gopkgs /go/bin/gopkgs /bin/
COPY --link --from=gotests /go/bin/gotests /bin/
COPY --link --from=gotestsum /go/bin/gotestsum /bin/

# Networking utilities
FROM scratch as tools-net
COPY --link --from=ghcr.io/olix0r/hokay:v0.2.3 /usr/local/bin/hokay /bin/

##
## All Tools
##

FROM scratch as tools
COPY --link --from=tools-go /bin/* /bin/
COPY --link --from=tools-k8s /bin/* /bin/
COPY --link --from=tools-k8s /etc/* /etc/
ENV K3S_IMAGES_JSON=/etc/k3s-images.json
COPY --link --from=tools-lint /bin/* /bin/
COPY --link --from=tools-net /bin/* /bin/
COPY --link --from=tools-oci /bin/* /bin/
COPY --link --from=tools-rust /bin/* /bin/
COPY --link --from=tools-script /bin/* /bin/

##
## Base images
##

# A Go build environment.
FROM docker.io/library/golang:${GO_TAG} as go
RUN --mount=type=cache,from=apt-base,source=/etc/apt,target=/etc/apt,sharing=locked \
    --mount=type=cache,from=apt-base,source=/var/cache/apt,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,from=apt-base,source=/var/lib/apt,target=/var/lib/apt,sharing=locked \
    DEBIAN_FRONTEND=noninteractive apt-get install -y file jo jq
COPY --link --from=tools-script /bin/* /usr/local/bin/
COPY --link --from=tools-go /bin/* /usr/local/bin/
COPY --link --from=protobuf /usr/local/bin/protoc /usr/local/bin/
COPY --link --from=protobuf /usr/local/include/google /usr/local/include/google
ENV PROTOC_NO_VENDOR=1 \
    PROTOC=/usr/local/bin/protoc \
    PROTOC_INCLUDE=/usr/local/include

# A Rust build environment.
FROM docker.io/library/rust:${RUST_TAG}-slim-${DEBIAN_RELEASE} as rust
RUN --mount=type=cache,from=apt-base,source=/etc/apt,target=/etc/apt,sharing=locked \
    --mount=type=cache,from=apt-base,source=/var/cache/apt,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,from=apt-base,source=/var/lib/apt,target=/var/lib/apt,sharing=locked \
    DEBIAN_FRONTEND=noninteractive apt-get install -y \
        cmake \
        curl \
        file \
        gh \
        git \
        jo \
        jq \
        libssl-dev \
        pkg-config
RUN --mount=type=cache,from=apt-base,source=/etc/apt,target=/etc/apt,sharing=locked \
    --mount=type=cache,from=apt-base,source=/var/cache/apt,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,from=apt-base,source=/var/lib/apt,target=/var/lib/apt,sharing=locked \
    DEBIAN_FRONTEND=noninteractive apt-get install -y clang-19 llvm-19
RUN rustup component add clippy rustfmt
COPY --link --from=tools-lint /bin/checksec /usr/local/bin/
COPY --link --from=tools-script /bin/* /usr/local/bin/
COPY --link --from=tools-rust /bin/* /usr/local/bin/
COPY --link --from=protobuf /usr/local/bin/protoc /usr/local/bin/
COPY --link --from=protobuf /usr/local/include/google /usr/local/include/google
ENV PROTOC_NO_VENDOR=1 \
    PROTOC=/usr/local/bin/protoc \
    PROTOC_INCLUDE=/usr/local/include
# Rust settings for CI
ENV CARGO_INCREMENTAL=0 \
    CARGO_NET_RETRY=10 \
    RUST_BACKTRACE=short \
    RUSTUP_MAX_RETRIES=10
ENTRYPOINT ["/usr/local/bin/just-cargo"]

FROM rust as rust-musl
RUN rustup target add \
        aarch64-unknown-linux-musl \
        x86_64-unknown-linux-musl
RUN --mount=type=cache,from=apt-base,source=/etc/apt,target=/etc/apt,sharing=locked \
    --mount=type=cache,from=apt-base,source=/var/cache/apt,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,from=apt-base,source=/var/lib/apt,target=/var/lib/apt,sharing=locked \
    DEBIAN_FRONTEND=noninteractive apt-get install -y \
        binutils-aarch64-linux-gnu \
        g++-aarch64-linux-gnu \
        gcc-aarch64-linux-gnu \
        libc6-dev-arm64-cross

##
## Devcontainer
##

FROM docker.io/library/debian:${DEBIAN_RELEASE} AS devcontainer
RUN --mount=type=cache,from=apt-base,source=/etc/apt,target=/etc/apt,sharing=locked \
    --mount=type=cache,from=apt-base,source=/var/cache/apt,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,from=apt-base,source=/var/lib/apt,target=/var/lib/apt,sharing=locked \
    DEBIAN_FRONTEND=noninteractive apt-get install -y \
        cmake \
        curl \
        dnsutils \
        file \
        git \
        gnupg2 \
        iproute2 \
        jo \
        jq \
        just \
        libssl-dev \
        locales \
        lsb-release \
        netcat-openbsd \
        node-json5 \
        pkg-config \
        skopeo \
        sudo \
        time \
        tshark \
        umoci \
        unzip \
        yq

# consumers use j5j as the interface to stripping comments from json
RUN ln -s /usr/bin/json5 /usr/local/bin/j5j

# Link the gnu versions of ranlib to the musl toolchain.
# See: https://github.com/linkerd/linkerd2/issues/13350
RUN ln -s /usr/bin/aarch64-linux-gnu-ranlib /usr/bin/aarch64-linux-musl-ranlib && \
    ln -s /usr/bin/x86_64-linux-gnu-ranlib /usr/bin/x86_64-linux-musl-ranlib

RUN sed -i 's/^# *\(en_US.UTF-8\)/\1/' /etc/locale.gen \
    && locale-gen \
    && (echo "LC_ALL=en_US.UTF-8" && echo "LANGUAGE=en_US.UTF-8") >/etc/default/locale

RUN groupadd --gid=1000 code \
    && useradd --create-home --uid=1000 --gid=1000 code \
    && echo "code ALL=(root) NOPASSWD:ALL" >/etc/sudoers.d/code \
    && chmod 0440 /etc/sudoers.d/code

RUN --mount=type=cache,from=apt-llvm,source=/etc/apt,target=/etc/apt,sharing=locked \
    --mount=type=cache,from=apt-llvm,source=/var/cache/apt,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,from=apt-llvm,source=/var/lib/apt,target=/var/lib/apt,sharing=locked \
    DEBIAN_FRONTEND=noninteractive apt-get install -y clang-19 llvm-19
ENV CC=clang-19 \
    CXX=clang++-19

# Install docker-compose since it breaks in the docker-debian script on arm64
RUN --mount=type=cache,from=apt-base,source=/etc/apt,target=/etc/apt,sharing=locked \
    --mount=type=cache,from=apt-base,source=/var/cache/apt,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,from=apt-base,source=/var/lib/apt,target=/var/lib/apt,sharing=locked \
    DEBIAN_FRONTEND=noninteractive apt-get install -y docker-compose

# devcontainers/features: install docker do not use moby (not supported on trixie)
# A distinct cache is used because the script adds an apt repo that we don't
# want to pull in for other layers.
RUN --mount=type=cache,from=apt-base,source=/etc/apt,target=/etc/apt,sharing=locked \
    --mount=type=cache,from=apt-base,source=/var/cache/apt,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,from=apt-base,source=/var/lib/apt,target=/var/lib/apt,sharing=locked \
    --mount=type=bind,from=tools,source=/bin/scurl,target=/usr/local/bin/scurl \
    scurl https://raw.githubusercontent.com/devcontainers/features/refs/heads/main/src/docker-outside-of-docker/install.sh | MOBY=false bash -s
ENV DOCKER_BUILDKIT=1

ARG MARKDOWNLINT_VERSION=0.22.1
RUN --mount=type=cache,from=apt-base,source=/etc/apt,target=/etc/apt,sharing=locked \
    --mount=type=cache,from=apt-base,source=/var/cache/apt,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,from=apt-base,source=/var/lib/apt,target=/var/lib/apt,sharing=locked \
    DEBIAN_FRONTEND=noninteractive apt-get update && apt-get install -y nodejs npm
RUN npm install "markdownlint-cli2@${MARKDOWNLINT_VERSION}" --global

COPY --link --from=go /usr/local/go /usr/local/go
ENV PATH="/usr/local/go/bin:$PATH"

ENV CARGO_HOME=/usr/local/cargo
ENV RUSTUP_HOME=/usr/local/rustup
COPY --link --from=rust $CARGO_HOME $CARGO_HOME
COPY --link --from=rust $RUSTUP_HOME $RUSTUP_HOME
RUN find "$CARGO_HOME" "$RUSTUP_HOME" -type d -exec chmod 777 '{}' +
ENV PATH="$CARGO_HOME/bin:$PATH"

COPY --link --from=protobuf /usr/local/bin/protoc /usr/local/bin/protoc
COPY --link --from=protobuf /usr/local/include/google /usr/local/include/google
ENV PROTOC_NO_VENDOR=1 \
    PROTOC=/usr/local/bin/protoc \
    PROTOC_INCLUDE=/usr/local/include

COPY --link bin/just-md /usr/local/bin/
COPY --link --from=tools /bin/* /usr/local/bin/
COPY --link --from=tools /etc/* /usr/local/etc/
ENV K3S_IMAGES_JSON=/usr/local/etc/k3s-images.json

ENV HOME=/home/code \
    USER=code
USER code
ENV GOPATH="$HOME/go"
RUN mkdir "$GOPATH"
ENV PATH="$GOPATH/bin:$PATH"

ENTRYPOINT ["/usr/local/share/docker-init.sh"]
CMD ["sleep", "infinity"]