FROM python:3.13.12-bookworm AS base

# Install non-Python dependencies
ARG DEBIAN_FRONTEND=noninteractive
RUN apt-get update --yes \
    && apt-get upgrade --yes \
    && apt-get install --yes --no-install-recommends \
        libnetcdf-c++4-dev \
        libgdal-dev \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

# Update pip and build tools for potential bug fixes and performance improvements
RUN pip install --no-cache-dir --root-user-action=ignore --upgrade pip build setuptools wheel

# Create a non-root user to run as
RUN useradd --create-home --home-dir "/home/pipuser" --user-group --uid 1000 pipuser
USER pipuser:pipuser
ENV PATH=/home/pipuser/.local/bin:$PATH
WORKDIR /home/pipuser/

# Build stage
FROM base AS build
SHELL ["/bin/bash", "-o", "pipefail", "-c"]

COPY --chown=pipuser:pipuser . /home/pipuser/l2o-gpp

# Install pinned runtime dependencies for reproducible environment
RUN pip install --user --no-cache-dir -r /home/pipuser/l2o-gpp/requirements.txt

# If provided, re-install l2o-* dependencies from Gitlab at the respective Git refs passed as build args.
# They should be unset or empty variables in tag/release pipelines
ARG L2O_COREALG_REF
ARG L2O_VAM_REF
ARG L2O_IO_REF
RUN --mount=type=secret,id=ci-job-token,uid=1000,gid=1000 \
    set -e; \
    TOKEN=$(cat /run/secrets/ci-job-token); \
    URLS=""; \
    if [ -n "$L2O_COREALG_REF" ] && [ "$L2O_COREALG_REF" != "DISABLE" ]; then \
        URLS="$URLS git+https://gitlab-ci-token:${TOKEN}@gitlab.dlr.de/rl2ocean/l2o-corealg.git@${L2O_COREALG_REF}"; \
    fi; \
    if [ -n "$L2O_VAM_REF" ] && [ "$L2O_VAM_REF" != "DISABLE" ]; then \
        URLS="$URLS git+https://gitlab-ci-token:${TOKEN}@gitlab.dlr.de/rl2ocean/l2o-vam.git@${L2O_VAM_REF}"; \
    fi; \
    if [ -n "$L2O_IO_REF" ] && [ "$L2O_IO_REF" != "DISABLE" ]; then \
        URLS="$URLS git+https://gitlab-ci-token:${TOKEN}@gitlab.dlr.de/rl2ocean/l2o-io.git@${L2O_IO_REF}"; \
    fi; \
    if [ -n "$URLS" ]; then \
        echo "$URLS" | xargs pip install --user --no-cache-dir; \
    fi

# Install l2o-gpp from source
RUN pip install --user --no-cache-dir --no-deps "/home/pipuser/l2o-gpp[all]"

# Final stage
FROM base AS final

# Copy installed Python packages into the final image
COPY --from=build --chown=pipuser:pipuser /home/pipuser/.local /home/pipuser/.local

# OCI annotations
# See https://github.com/opencontainers/image-spec/blob/main/annotations.md#pre-defined-annotation-keys
ARG CI_COMMIT_SHA
LABEL org.opencontainers.image.title="ESA RL2Ocean Ground Prototype Processor"
LABEL org.opencontainers.image.description="ESA ROSE-L Level-2 Ocean Ground Prototype Processor"
LABEL org.opencontainers.image.source="https://gitlab.dlr.de/rl2ocean/l2o-gpp"
LABEL org.opencontainers.image.url="https://gitlab.dlr.de/rl2ocean/l2o-gpp/-/blob/main/Dockerfile"
LABEL org.opencontainers.image.revision="$CI_COMMIT_SHA"
LABEL org.opencontainers.image.vendor="ESA"
LABEL org.opencontainers.image.authors="RL2Ocean Team"
LABEL org.opencontainers.image.base.name="python:3.13.12-bookworm"
