# syntax=docker/dockerfile:1.4
ARG PYTHON_BASE_IMAGE="python:3.14.8-slim-trixie"
ARG UID="9999"
ARG GID="9999"

# =============================================================================
# Builder for su-exec (replaces gosu, safer with smaller footprint)
# Pinned to v0.2 (commit 212b75144bbc) with SHA256 verification
# =============================================================================
FROM debian:trixie-slim AS tool-builder

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

ENV SU_EXEC_VERSION=212b75144bbc06722fbd7661f651390dc47a43d1 \
    SU_EXEC_SHA256=d6c40440609a23483f12eb6295b5191e94baf08298a856bab6e15b10c3b82891

# hadolint ignore=DL3008
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update && \
    apt-get upgrade -y && \
    apt-get install -y --no-install-recommends ca-certificates curl build-essential dos2unix tini && \
    curl -fsSL -o /usr/local/bin/su-exec.c "https://github.com/ncopa/su-exec/raw/${SU_EXEC_VERSION}/su-exec.c" && \
    echo "${SU_EXEC_SHA256}  /usr/local/bin/su-exec.c" | sha256sum -c - && \
    gcc -Wall -Werror -static -o /usr/local/bin/su-exec /usr/local/bin/su-exec.c && \
    chmod 0755 /usr/local/bin/su-exec


# =============================================================================
# Builder for Wasmtime (used to execute untrusted code in a separate WASI process)
# =============================================================================
FROM debian:trixie-slim AS wasmtime-builder
ARG TARGETARCH
# Stay on an LTS line (versions divisible by 12): only those get security fixes for 24 months.
ARG WASMTIME_VERSION=48.0.5
ARG WASMTIME_SHA256_AMD64=f533a0fb3eca20aee34d69192f214839c5227a507fff2ecb3070ae1a37f0c40d
ARG WASMTIME_SHA256_ARM64=8713dcbc6f9427eb120d7a4b514b6a58597a369e5b5d79cebeaae11fa24479f5

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

# hadolint ignore=DL3008
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update && \
    apt-get install -y --no-install-recommends ca-certificates curl xz-utils && \
    case "${TARGETARCH}" in \
        amd64) WASMTIME_ARCH="x86_64-linux" WASMTIME_SHA256="${WASMTIME_SHA256_AMD64}" ;; \
        arm64) WASMTIME_ARCH="aarch64-linux" WASMTIME_SHA256="${WASMTIME_SHA256_ARM64}" ;; \
        *) echo "Unsupported architecture: ${TARGETARCH}" && exit 1 ;; \
    esac && \
    curl -fsSL \
        "https://github.com/bytecodealliance/wasmtime/releases/download/v${WASMTIME_VERSION}/wasmtime-v${WASMTIME_VERSION}-${WASMTIME_ARCH}.tar.xz" \
        -o /tmp/wasmtime.tar.xz && \
    echo "${WASMTIME_SHA256}  /tmp/wasmtime.tar.xz" | sha256sum -c - && \
    tar -xJf /tmp/wasmtime.tar.xz -C /tmp && \
    mv "/tmp/wasmtime-v${WASMTIME_VERSION}-${WASMTIME_ARCH}/wasmtime" /usr/local/bin/wasmtime && \
    chmod 0755 /usr/local/bin/wasmtime


# =============================================================================
# Builder for mox (inbound SMTP receiver for the email trigger feature)
# =============================================================================
FROM golang:1.27-trixie AS mox-builder
ARG MOX_VERSION=v0.0.17
# mox v0.0.17 pins vulnerable x/crypto v0.55.0 and x/net v0.58.0; drop once a mox release bumps them.
ARG MOX_X_CRYPTO_VERSION=v0.57.0
ARG MOX_X_NET_VERSION=v0.60.0

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

# `go mod download` and `go get` check every module against sum.golang.org.
WORKDIR /src/mox
RUN go mod download "github.com/mjl-/mox@${MOX_VERSION}" && \
    cp -r "$(go env GOMODCACHE)/github.com/mjl-/mox@${MOX_VERSION}/." . && \
    chmod -R u+w . && \
    go get "golang.org/x/crypto@${MOX_X_CRYPTO_VERSION}" "golang.org/x/net@${MOX_X_NET_VERSION}" && \
    CGO_ENABLED=0 go build -trimpath -o /usr/local/bin/mox . && \
    chmod 0755 /usr/local/bin/mox


# =============================================================================
# Builder for QuickJS-NG WASI runtime
# =============================================================================
FROM debian:trixie-slim AS quickjs-wasi-builder
ARG TARGETARCH
ARG QUICKJS_NG_VERSION=0.15.0
ARG WASI_SDK_VERSION=27

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

# hadolint ignore=DL3008
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update && \
    apt-get install -y --no-install-recommends ca-certificates cmake curl make tar && \
    case "${TARGETARCH}" in \
        amd64) WASI_SDK_ARCH="x86_64" ;; \
        arm64) WASI_SDK_ARCH="arm64" ;; \
        *) echo "Unsupported architecture: ${TARGETARCH}" && exit 1 ;; \
    esac && \
    curl -fsSL \
        "https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${WASI_SDK_VERSION}/wasi-sdk-${WASI_SDK_VERSION}.0-${WASI_SDK_ARCH}-linux.tar.gz" \
        -o /tmp/wasi-sdk.tar.gz && \
    tar -xzf /tmp/wasi-sdk.tar.gz -C /opt && \
    mv "/opt/wasi-sdk-${WASI_SDK_VERSION}.0-${WASI_SDK_ARCH}-linux" /opt/wasi-sdk && \
    curl -fsSL \
        "https://github.com/quickjs-ng/quickjs/archive/refs/tags/v${QUICKJS_NG_VERSION}.tar.gz" \
        -o /tmp/quickjs-ng.tar.gz && \
    mkdir -p /tmp/quickjs-ng && \
    tar -xzf /tmp/quickjs-ng.tar.gz -C /tmp/quickjs-ng --strip-components=1 && \
    cmake \
        -S /tmp/quickjs-ng \
        -B /tmp/quickjs-ng/build \
        -DCMAKE_TOOLCHAIN_FILE=/opt/wasi-sdk/share/cmake/wasi-sdk.cmake \
        -DCMAKE_BUILD_TYPE=Release \
        -DQJS_BUILD_WERROR=OFF && \
    cmake --build /tmp/quickjs-ng/build --target qjs_exe --parallel && \
    mkdir -p /usr/local/lib/baserow && \
    if [[ -f /tmp/quickjs-ng/build/qjs.wasm ]]; then \
        cp /tmp/quickjs-ng/build/qjs.wasm /usr/local/lib/baserow/qjs.wasm; \
    else \
        cp /tmp/quickjs-ng/build/qjs /usr/local/lib/baserow/qjs.wasm; \
    fi


# =============================================================================
# Local/export target for code runner artifacts
# =============================================================================
FROM scratch AS code-runner-artifacts

COPY --from=wasmtime-builder /usr/local/bin/wasmtime /bin/wasmtime
COPY --from=quickjs-wasi-builder /usr/local/lib/baserow/qjs.wasm /lib/baserow/qjs.wasm


# =============================================================================
# Production base builder stage: builds runtime dependencies only
# =============================================================================
FROM ${PYTHON_BASE_IMAGE} AS builder-prod-base
ARG UID
ARG GID

# Runtime dependencies only - this layer is always cached
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update && \
    apt-get upgrade -y && \
    apt-get install -y --no-install-recommends \
    build-essential \
    libpq-dev

ENV UV_PYTHON_DOWNLOADS=0 \
    UV_COMPILE_BYTECODE=1 \
    UV_LINK_MODE=copy \
    UV_PROJECT_ENVIRONMENT=/baserow/venv \
    UV_CACHE_DIR=/tmp/baserow_uv_cache \
    UV_VERBOSE=1 \
    PYTHONUNBUFFERED=1 \
    PATH="/baserow/venv/bin:$PATH" \
    PYTHONPATH="/baserow/backend/src:/baserow/premium/backend/src:/baserow/enterprise/backend/src"

# hadolint ignore=DL3022
COPY --from=ghcr.io/astral-sh/uv:0.12.24 /uv /uvx /bin/

# Create baserow directory structure (including subdirs for COPY targets)
RUN mkdir -p /baserow/ && chown -R $UID:$GID /baserow/
    
USER $UID:$GID
WORKDIR /baserow/backend

RUN --mount=type=cache,target=$UV_CACHE_DIR,sharing=locked,uid=$UID,gid=$GID \
    --mount=type=bind,source=LICENSE,target=/baserow/LICENSE \
    --mount=type=bind,source=backend/uv.lock,target=/baserow/backend/uv.lock \
    --mount=type=bind,source=backend/pyproject.toml,target=/baserow/backend/pyproject.toml \
    --mount=type=bind,source=premium/LICENSE,target=/baserow/premium/LICENSE \
    --mount=type=bind,source=premium/backend/pyproject.toml,target=/baserow/premium/backend/pyproject.toml \
    --mount=type=bind,source=enterprise/LICENSE,target=/baserow/enterprise/LICENSE \
    --mount=type=bind,source=enterprise/backend/pyproject.toml,target=/baserow/enterprise/backend/pyproject.toml \
    uv sync --frozen --no-dev --no-install-workspace --no-install-project \
    && find /baserow/venv -type f \( -name "*.c" -o -name "*.h" \) -not -path "*/autobahn/*" -delete \
    # Strip test/doc directories from site-packages (keep django/drf tests - used at runtime)
    # Keep botocore/docs and boto3/docs - they're imported at runtime
    && (find /baserow/venv/lib -type d \( -name "test" -o -name "tests" \) \
        -not -path "*/django/*" -not -path "*/rest_framework/*" -prune -exec rm -rf {} \; || true) \
    && (find /baserow/venv/lib -type d \( -name "doc" -o -name "docs" -o -name "example" -o -name "examples" \) \
        -not -path "*/botocore/*" -not -path "*/boto3/*" -prune -exec rm -rf {} \; || true)


# =============================================================================
# CI Builder - includes dev dependencies for testing
# =============================================================================
FROM builder-prod-base AS builder-ci
ARG UID
ARG GID

USER $UID:$GID
WORKDIR /baserow/backend

COPY --chown=$UID:$GID LICENSE /baserow/LICENSE
COPY --chown=$UID:$GID premium/LICENSE /baserow/premium/LICENSE
COPY --chown=$UID:$GID enterprise/LICENSE /baserow/enterprise/LICENSE

# Install dev dependencies before copying source code to leverage caching
RUN --mount=type=cache,target=$UV_CACHE_DIR,sharing=locked,uid=$UID,gid=$GID \
    --mount=type=bind,source=backend/uv.lock,target=/baserow/backend/uv.lock \
    --mount=type=bind,source=backend/pyproject.toml,target=/baserow/backend/pyproject.toml \
    --mount=type=bind,source=premium/backend/pyproject.toml,target=/baserow/premium/backend/pyproject.toml \
    --mount=type=bind,source=enterprise/backend/pyproject.toml,target=/baserow/enterprise/backend/pyproject.toml \
    uv sync --frozen --no-install-workspace --no-install-project \
    && find /baserow/venv -type f \( -name "*.c" -o -name "*.h" \) -not -path "*/autobahn/*" -delete \
    # Strip test/doc directories from site-packages (keep django/drf tests - used at runtime)
    # Keep botocore/docs and boto3/docs - they're imported at runtime
    && (find /baserow/venv/lib -type d \( -name "test" -o -name "tests" \) \
        -not -path "*/django/*" -not -path "*/rest_framework/*" -prune -exec rm -rf {} \; || true) \
    && (find /baserow/venv/lib -type d \( -name "doc" -o -name "docs" -o -name "example" -o -name "examples" \) \
        -not -path "*/botocore/*" -not -path "*/boto3/*" -prune -exec rm -rf {} \; || true)

COPY --from=tool-builder /usr/bin/dos2unix /usr/local/bin/dos2unix

# Copy source code and tests

COPY --chown=$UID:$GID backend /baserow/backend
COPY --chown=$UID:$GID premium/backend /baserow/premium/backend
COPY --chown=$UID:$GID enterprise/backend /baserow/enterprise/backend

COPY --chown=$UID:$GID tests /baserow/tests

USER $UID:$GID
WORKDIR /baserow/backend

RUN dos2unix /baserow/backend/docker/docker-entrypoint.sh \
    && chmod a+x /baserow/backend/docker/docker-entrypoint.sh

# Install the project with premium and enterprise plugins
RUN --mount=type=cache,target=$UV_CACHE_DIR,sharing=locked,uid=$UID,gid=$GID \
    uv sync --frozen \
    && find /baserow/venv -type f \( -name "*.c" -o -name "*.h" \) -not -path "*/autobahn/*" -delete \
    # Strip test/doc directories from site-packages (keep django/drf tests - used at runtime)
    # Keep botocore/docs and boto3/docs - they're imported at runtime
    && (find /baserow/venv/lib -type d \( -name "test" -o -name "tests" \) \
        -not -path "*/django/*" -not -path "*/rest_framework/*" -prune -exec rm -rf {} \; || true) \
    && (find /baserow/venv/lib -type d \( -name "doc" -o -name "docs" -o -name "example" -o -name "examples" \) \
        -not -path "*/botocore/*" -not -path "*/boto3/*" -prune -exec rm -rf {} \; || true)

# =============================================================================
# Production builder stage - creates runtime packages only
# =============================================================================
FROM builder-prod-base AS builder-prod
ARG UID
ARG GID

COPY --from=tool-builder /usr/bin/dos2unix /usr/local/bin/dos2unix

USER $UID:$GID
WORKDIR /baserow/backend

# Copy source code
COPY --chown=$UID:$GID LICENSE /baserow/LICENSE
COPY --chown=$UID:$GID backend /baserow/backend

COPY --chown=$UID:$GID premium/LICENSE /baserow/premium/LICENSE
COPY --chown=$UID:$GID premium/backend /baserow/premium/backend

COPY --chown=$UID:$GID enterprise/LICENSE /baserow/enterprise/LICENSE
COPY --chown=$UID:$GID enterprise/backend /baserow/enterprise/backend

RUN dos2unix /baserow/backend/docker/docker-entrypoint.sh \
    && chmod a+x /baserow/backend/docker/docker-entrypoint.sh

# Install the project with premium and enterprise workspaces
RUN --mount=type=cache,target=$UV_CACHE_DIR,sharing=locked,uid=$UID,gid=$GID \
    uv sync --frozen --no-dev \
    && find /baserow/venv -type f \( -name "*.c" -o -name "*.h" \) -not -path "*/autobahn/*" -delete \
    # Strip test/doc directories from site-packages (keep django/drf tests - used at runtime)
    # Keep botocore/docs and boto3/docs - they're imported at runtime
    && (find /baserow/venv/lib -type d \( -name "test" -o -name "tests" \) \
        -not -path "*/django/*" -not -path "*/rest_framework/*" -prune -exec rm -rf {} \; || true) \
    && (find /baserow/venv/lib -type d \( -name "doc" -o -name "docs" -o -name "example" -o -name "examples" \) \
        -not -path "*/botocore/*" -not -path "*/boto3/*" -prune -exec rm -rf {} \; || true)


# =============================================================================
# CI Target - lightweight image for pytest and E2E tests
# =============================================================================
FROM ${PYTHON_BASE_IMAGE} AS ci
ARG UID
ARG GID

RUN apt-get update && \
    apt-get upgrade -y && \
    apt-get install -y --no-install-recommends \
    gettext \
    xmlsec1 \
    && apt-get clean && rm -rf /var/lib/apt/lists/*

ENV DOCKER_USER=baserow_docker_user \
    BASEROW_IMAGE_TYPE="backend" \
    PYTHONUNBUFFERED=1 \
    UV_PROJECT_ENVIRONMENT=/baserow/venv \
    UV_CACHE_DIR=/tmp/baserow_uv_cache \
    PATH="/baserow/venv/bin:$PATH" \
    PYTHONPATH="/baserow/backend/src:/baserow/premium/backend/src:/baserow/enterprise/backend/src:/baserow/backend/tests:/baserow/premium/backend/tests:/baserow/enterprise/backend/tests" \
    DJANGO_SETTINGS_MODULE='baserow.config.settings.test'

RUN groupadd --system --gid $GID ${DOCKER_USER} && \
      useradd --shell /bin/bash -l -u $UID -g $GID -o -c "" -d /baserow -m ${DOCKER_USER} && \
      chmod 755 /baserow

COPY --from=tool-builder /usr/local/bin/su-exec /usr/local/bin/su-exec
COPY --from=tool-builder /usr/bin/tini /usr/bin/tini
COPY --from=wasmtime-builder /usr/local/bin/wasmtime /usr/local/bin/wasmtime
COPY --from=mox-builder /usr/local/bin/mox /usr/local/bin/mox
COPY --from=quickjs-wasi-builder /usr/local/lib/baserow/qjs.wasm /usr/local/lib/baserow/qjs.wasm
# hadolint ignore=DL3022
COPY --from=ghcr.io/astral-sh/uv:0.12.24 /uv /uvx /bin/

# Create baserow directory structure (including subdirs for COPY targets)
RUN mkdir -p /baserow/backend/reports /baserow/premium/backend /baserow/enterprise/backend /baserow/media && \
    chown -R $UID:$GID /baserow/

# Copy the virtual environment and source code with tests
COPY --chown=$UID:$GID --from=builder-ci /baserow /baserow
COPY --chown=$UID:$GID ./docs /baserow/docs/
COPY --chown=$UID:$GID deploy/plugins/*.sh /baserow/plugins/

USER $UID:$GID
WORKDIR /baserow/backend
ENTRYPOINT ["/usr/bin/tini", "--", "/bin/bash", "/baserow/backend/docker/docker-entrypoint.sh"]


# =============================================================================
# Dev image: includes dev dependencies and tools for local development
# Only works mounting the source code as a bind mount. See docker-compose.dev.yml for usage.
# =============================================================================

FROM ${PYTHON_BASE_IMAGE} AS dev
ARG UID="9999"
ARG GID="9999"

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

# Build dependencies - this layer is always cached
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update && \
    apt-get upgrade -y && \
    apt-get install -y --no-install-recommends curl ca-certificates \
    && curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc -o /usr/share/keyrings/pgdg.asc \
    && echo "deb [signed-by=/usr/share/keyrings/pgdg.asc] https://apt.postgresql.org/pub/repos/apt trixie-pgdg main" > /etc/apt/sources.list.d/pgdg.list \
    && apt-get update \
    && apt-get install -y --no-install-recommends \
    build-essential \
    ca-certificates \
    postgresql-client-15 \
    gettext \
    xmlsec1 \
    curl \
    graphviz \
    procps \
    tmux \
    vim \
    lsof \
    sudo

ENV DOCKER_USER=baserow_docker_user \
    BASEROW_IMAGE_TYPE="backend" \
    UV_PYTHON_DOWNLOADS=0 \
    UV_COMPILE_BYTECODE=0 \
    UV_LINK_MODE=copy \
    UV_PROJECT_ENVIRONMENT=/baserow/venv \
    UV_CACHE_DIR=/tmp/baserow_uv_cache_dev \
    PYTHONUNBUFFERED=1 \
    PATH=/baserow/venv/bin:$PATH \
    PYTHONPATH=/baserow/backend/src:/baserow/premium/backend/src:/baserow/enterprise/backend/src:/baserow/backend/tests:/baserow/premium/backend/tests:/baserow/enterprise/backend/tests \
    DJANGO_SETTINGS_MODULE=baserow.config.settings.dev

RUN getent group $GID || groupadd --system --gid $GID ${DOCKER_USER} && \
    useradd --shell /bin/bash -l -u $UID -g $GID -o -c "" -d /baserow -m ${DOCKER_USER} && \
    chmod 755 /baserow && \
    echo "${DOCKER_USER} ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/${DOCKER_USER} && \
    chmod 0440 /etc/sudoers.d/${DOCKER_USER}

COPY --from=tool-builder /usr/local/bin/su-exec /usr/local/bin/su-exec
COPY --from=tool-builder /usr/bin/tini /usr/bin/tini
COPY --from=tool-builder /usr/bin/dos2unix /usr/local/bin/dos2unix
COPY --from=wasmtime-builder /usr/local/bin/wasmtime /usr/local/bin/wasmtime
COPY --from=mox-builder /usr/local/bin/mox /usr/local/bin/mox
COPY --from=quickjs-wasi-builder /usr/local/lib/baserow/qjs.wasm /usr/local/lib/baserow/qjs.wasm
# hadolint ignore=DL3022
COPY --from=ghcr.io/astral-sh/uv:0.12.24 /uv /uvx /bin/

# Create directory structure to install dependencies
RUN mkdir -p /baserow/backend/docker /baserow/premium/ /baserow/enterprise/ /baserow/media && \
    chown -R $UID:$GID /baserow/

USER $UID:$GID
WORKDIR /baserow/backend

# Install all dependencies
COPY --chown=$UID:$GID LICENSE /baserow/LICENSE
COPY --chown=$UID:$GID premium/LICENSE /baserow/premium/LICENSE
COPY --chown=$UID:$GID enterprise/LICENSE /baserow/enterprise/LICENSE

RUN --mount=type=cache,target=$UV_CACHE_DIR,sharing=locked,uid=$UID,gid=$GID \
    --mount=type=bind,source=backend/uv.lock,target=/baserow/backend/uv.lock \
    --mount=type=bind,source=backend/pyproject.toml,target=/baserow/backend/pyproject.toml \
    --mount=type=bind,source=premium/backend/pyproject.toml,target=/baserow/premium/backend/pyproject.toml \
    --mount=type=bind,source=enterprise/backend/pyproject.toml,target=/baserow/enterprise/backend/pyproject.toml \
    uv sync --frozen --no-install-workspace --no-install-project

# Configure tmux and bashrc
RUN echo "set -g default-command \"\${SHELL}\"" > /baserow/.tmux.conf && \
    printf '%s\n' \
    '# Aliases' \
    'alias j="just"' \
    'alias m="python /baserow/backend/src/baserow/manage.py"' \
    'alias pytest="python -m pytest"' \
    '' \
    '# Show a helpful message' \
    'echo "Baserow backend dev container"' \
    'echo "  m <cmd>     - Django manage.py (e.g., m shell_plus)"' \
    'echo "  pytest      - Run tests"' \
    'echo "  j           - See available commands"' \
    > /baserow/.bashrc

COPY --chown=$UID:$GID backend/docker/docker-entrypoint.sh /baserow/backend/docker/docker-entrypoint.sh
RUN dos2unix /baserow/backend/docker/docker-entrypoint.sh \
    && chmod a+x /baserow/backend/docker/docker-entrypoint.sh

HEALTHCHECK --interval=60s CMD ["/bin/bash", "/baserow/backend/docker/docker-entrypoint.sh", "backend-healthcheck"]
ENTRYPOINT ["/usr/bin/tini", "--", "/bin/bash", "/baserow/backend/docker/docker-entrypoint.sh"]
CMD ["django-dev"]


# =============================================================================
# Production target
# =============================================================================
FROM ${PYTHON_BASE_IMAGE} AS local
ARG UID
ARG GID

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

ENV POSTGRES_VERSION=15 \
    DOCKER_USER=baserow_docker_user \
    BASEROW_IMAGE_TYPE="backend" \
    UV_PROJECT_ENVIRONMENT=/baserow/venv \
    PYTHONUNBUFFERED=1 \
    PATH="/baserow/venv/bin:$PATH" \
    PYTHONPATH="/baserow/backend/src:/baserow/premium/backend/src:/baserow/enterprise/backend/src" \
    DJANGO_SETTINGS_MODULE='baserow.config.settings.base'

# Runtime dependencies only
RUN apt-get update && \
    apt-get upgrade -y && \
    apt-get install -y --no-install-recommends curl ca-certificates \
    && curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc -o /usr/share/keyrings/pgdg.asc \
    && echo "deb [signed-by=/usr/share/keyrings/pgdg.asc] https://apt.postgresql.org/pub/repos/apt trixie-pgdg main" > /etc/apt/sources.list.d/pgdg.list \
    && apt-get update \
    && apt-get install -y --no-install-recommends \
    xmlsec1 \
    gettext \
    postgresql-client-${POSTGRES_VERSION} \
    && apt-get clean && rm -rf /var/lib/apt/lists/*

# Plugin installs bootstrap pip into the app venv, so the system pip only adds CVEs. -B keeps .pyc files out of this layer.
RUN python3 -B -m pip uninstall -y --root-user-action=ignore pip

RUN groupadd --system --gid $GID ${DOCKER_USER} && \
      useradd --shell /bin/bash -l -u $UID -g $GID -o -c "" -d /baserow -m ${DOCKER_USER} && \
      chmod 755 /baserow

# In slim docker images, mime.types is removed and we need it for mimetypes guessing
COPY ./backend/docker/mime.types /etc/
COPY --from=tool-builder /usr/local/bin/su-exec /usr/local/bin/su-exec
COPY --from=tool-builder /usr/bin/tini /usr/bin/tini
COPY --from=wasmtime-builder /usr/local/bin/wasmtime /usr/local/bin/wasmtime
COPY --from=mox-builder /usr/local/bin/mox /usr/local/bin/mox
COPY --from=quickjs-wasi-builder /usr/local/lib/baserow/qjs.wasm /usr/local/lib/baserow/qjs.wasm

RUN mkdir -p /baserow/media && chown -R $UID:$GID /baserow/

# Copy the virtual environment with the production dependencies
COPY --chown=$UID:$GID --from=builder-prod /baserow/venv /baserow/venv/

COPY --chown=$UID:$GID LICENSE /baserow/LICENSE
COPY --chown=$UID:$GID --from=builder-prod /baserow/backend /baserow/backend/
COPY --chown=$UID:$GID --from=builder-prod /baserow/premium /baserow/premium/
COPY --chown=$UID:$GID --from=builder-prod /baserow/enterprise /baserow/enterprise/
COPY --chown=$UID:$GID ./docs /baserow/docs/

# Remove application tests and dev-only directories
RUN rm -rf /baserow/backend/tests /baserow/premium/backend/tests \
        /baserow/enterprise/backend/tests /baserow/backend/email_compiler

COPY --chown=$UID:$GID deploy/plugins/*.sh /baserow/plugins/

USER $UID:$GID
WORKDIR /baserow/backend

HEALTHCHECK --interval=60s CMD ["/bin/bash", "/baserow/backend/docker/docker-entrypoint.sh", "backend-healthcheck"]
ENTRYPOINT ["/usr/bin/tini", "--", "/bin/bash", "/baserow/backend/docker/docker-entrypoint.sh"]
CMD ["gunicorn"]


FROM local AS prod

CMD ["gunicorn"]
