# The base every PHP AWD gamebox's app service builds FROM.
#
# Two jobs, and the gamebox adds only its own source and configuration:
#
# 1. **An ordinary server's toolset.** A defender logging into their box
#    should find what a normal Linux host has — a real shell, ps/top,
#    ss/ip, lsof, an editor, curl, diff/patch — or a SHELL-mode match
#    measures missing tools instead of defence. Everyday operations only;
#    nothing offensive.
# 2. **The process manager and its control command** (`ctfy-appd` as
#    PID 1, `appctl` for the defender). See each file's header for the
#    contract: the service starts once, is never restarted on crash or on
#    edit, and is started, stopped and restarted only by `appctl`.
# 3. **`openssh`, for the classic-AWD "open" shell exposure (#1725).**
#    `ctfy-appd` starts `sshd` *in this container* only when the platform
#    sets `CTFY_OPEN_SHELL=1` (a match whose `shell_exposure` is `open`);
#    `shadow` gives `chpasswd` so `appctl passwd` can rotate it.
#
# ⚠️ **Installed here, never in a gamebox.** The PATCH judge rebuilds a
# gamebox with the build network closed (`patch.build_network` defaults to
# false), so an `apk add` in a box's own Dockerfile would make every patch
# `build_failed`. A published base needs no network at box-build time.
#
# ⚠️ `ctfy-appd` and `appctl` are byte-identical across the three
# awd-base-* contexts; `test_awd_base_images.py` checks it.
FROM php:8.3-cli-alpine

RUN apk add --no-cache \
      bash coreutils procps-ng less vim curl \
      iproute2 iproute2-ss lsof diffutils patch findutils grep sed \
      openssh shadow

COPY --chmod=0755 ctfy-appd appctl /usr/local/bin/

ENTRYPOINT ["/usr/local/bin/ctfy-appd"]

# Provenance (#1802; keys: ctfy/core/image_labels.py). A host build passes
# CTFY_GIT_COMMIT / CTFY_VERSION; CI's metadata-action writes the same OCI
# keys and its values win. Last, so a changed commit re-runs no layer.
ARG CTFY_GIT_COMMIT=""
ARG CTFY_VERSION=""
LABEL org.opencontainers.image.source="https://github.com/wangyihang/ctfy" \
      org.opencontainers.image.vendor="ctfy" \
      org.opencontainers.image.revision="${CTFY_GIT_COMMIT}" \
      org.opencontainers.image.version="${CTFY_VERSION}" \
      io.ctfy.component="ctfy-awd-base-php"
