#syntax=docker/dockerfile:1.19.0@sha256:b6afd42430b15f2d2a4c5a02b919e98a525b785b1aaff16747d2f623364e39b6

FROM --platform=$BUILDPLATFORM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS entrypoint

ARG TARGETOS
ARG TARGETARCH
WORKDIR /src
COPY entrypoint/ ./
RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \
    go build -trimpath -ldflags='-s -w' -o /out/hawk-viewer-plugin-entrypoint .

# Same base as hawk/services/modules/viewer/Dockerfile.
FROM dhi.io/nginx@sha256:9c85848a89c938b4c2ce5ea515f1107774cd7aa61a5e430f3fed80790c6ceeb7

LABEL org.opencontainers.image.title="hawk-viewer-plugin-base" \
      org.opencontainers.image.description="Base image for same-origin Hawk viewer plug-ins" \
      org.opencontainers.image.source="https://github.com/METR/hawk" \
      org.opencontainers.image.licenses="MIT"

COPY --from=entrypoint --chmod=0755 /out/hawk-viewer-plugin-entrypoint /usr/local/bin/hawk-viewer-plugin-entrypoint
COPY --chmod=0644 nginx.conf /etc/nginx/nginx.conf
COPY --chmod=0644 server.conf.tmpl /etc/nginx/hawk-viewer-plugin-server.conf.tmpl
COPY --chmod=0644 placeholder/index.html /usr/share/nginx/html/index.html

# ECS copies /tmp's writable permissions only for declared volumes.
VOLUME ["/tmp"]

USER 65532
EXPOSE 8080
ENTRYPOINT ["/usr/local/bin/hawk-viewer-plugin-entrypoint"]
CMD ["-g", "daemon off;"]
