# The base every compiled (C) AWD gamebox's app service builds FROM.
#
# Same two jobs as `awd-base-python`: an ordinary server's toolset for the
# defender, and the process manager (`ctfy-appd`, PID 1) with its control
# command (`appctl`). A compiled box sets `APP_BUILD`, so `appctl start`
# and `restart` rebuild from the edited source first and keep the last
# good build when that fails.
#
# ⚠️ **gcc:14-bookworm, not alpine + `apk add gcc`**: the compiler must be
# in the base, because the PATCH judge builds a gamebox with the build
# network closed. Debian here, so the toolset is apt's names for the same
# tools — `openssh-server` + `passwd` for the classic-AWD "open" shell
# exposure (#1725), which `ctfy-appd` starts only when the platform sets
# `CTFY_OPEN_SHELL=1`; `passwd` gives `chpasswd` for `appctl passwd`.
#
# ⚠️ `ctfy-appd` and `appctl` are byte-identical across the three
# awd-base-* contexts; `test_awd_base_images.py` checks it.
FROM gcc:14-bookworm

RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      procps less vim-tiny curl iproute2 lsof diffutils patch \
      openssh-server passwd \
 && rm -rf /var/lib/apt/lists/*

COPY --chmod=0755 ctfy-appd appctl /usr/local/bin/

ENTRYPOINT ["/usr/local/bin/ctfy-appd"]

# Provenance (#1802; keys: ctfy/core/image_labels.py). A host build passes
# CTFY_GIT_COMMIT / CTFY_VERSION; CI's metadata-action writes the same OCI
# keys and its values win. Last, so a changed commit re-runs no layer.
ARG CTFY_GIT_COMMIT=""
ARG CTFY_VERSION=""
LABEL org.opencontainers.image.source="https://github.com/wangyihang/ctfy" \
      org.opencontainers.image.vendor="ctfy" \
      org.opencontainers.image.revision="${CTFY_GIT_COMMIT}" \
      org.opencontainers.image.version="${CTFY_VERSION}" \
      io.ctfy.component="ctfy-awd-base-gcc"
