# syntax=docker/dockerfile:1
FROM dhi.io/node:24.20.0-debian13-dev
LABEL maintainer="Penpot <docker@penpot.app>"

ENV LANG=en_US.UTF-8 \
    LC_ALL=en_US.UTF-8 \
    DEBIAN_FRONTEND=noninteractive

# passwd provides useradd, not preinstalled on the DHI base image.
RUN set -ex; \
    apt-get -qq update; \
    apt-get -qqy --no-install-recommends install passwd; \
    useradd -U -M -u 1001 -s /bin/false -d /opt/penpot penpot; \
    apt-get -qq -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" dist-upgrade; \
    apt-get -qqy --no-install-recommends install \
      curl \
      tzdata \
      locales \
      ca-certificates \
    ; \
    apt-get clean; \
    rm -rf /var/lib/apt/lists/*; \
    echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen; \
    locale-gen; \
    find /usr/share/i18n/locales/ -type f ! -name "en_US" ! -name "POSIX" ! -name "C" -delete;

RUN set -ex; \
    apt-get -qq update; \
    apt-get -qqy --no-install-recommends install \
      fontforge \
      woff-tools \
      woff2 \
      \
      libgomp1 \
      libheif1 \
      libjpeg62-turbo \
      liblcms2-2 \
      libopenexr-3-1-30 \
      libopenjp2-7 \
      libpng16-16 \
      librsvg2-2 \
      libtiff6 \
      libwebp7 \
      libwebpdemux2 \
      libwebpmux3 \
      libxml2 \
      libzip5 \
      libzstd1 \
    ; \
    apt-get clean; \
    rm -rf /var/lib/apt/lists/*; \
    mkdir -p /opt/penpot; \
    chown -R penpot:penpot /opt/penpot;

ARG BUNDLE_PATH="./bundle-media-processor/"
COPY --chown=penpot:penpot $BUNDLE_PATH /opt/penpot/media-processor/

WORKDIR /opt/penpot/media-processor

# pnpm ships as a system binary (same tarball + SHA pin as
# docker/devenv/Dockerfile); ./setup expects it on PATH.
# Corepack is gone from Node 25+, so nothing here may use it.
ARG PNPM_VERSION=12.5.1
RUN set -eux; \
    apt-get -qq update; \
    apt-get -qqy --no-install-recommends install gzip; \
    rm -rf /var/lib/apt/lists/*; \
    ARCH="$(dpkg --print-architecture)"; \
    case "${ARCH}" in \
       aarch64|arm64) \
         PNPM_ARCH='arm64'; \
         PNPM_SHA256='84e1290e82c800acd406b6db27e9650e15db3c2344d12162cc305ea1f942c6ff'; \
         ;; \
       amd64|x86_64) \
         PNPM_ARCH='x64'; \
         PNPM_SHA256='5a397dfb6b3d4b07d3d7769586aeb471048faf04299a492e2808b95a9a1c701f'; \
         ;; \
       *) \
         echo "Unsupported arch: ${ARCH}"; \
         exit 1; \
         ;; \
    esac; \
    curl -LfsSo /tmp/pnpm.tar.gz "https://github.com/pnpm/pnpm/releases/download/v${PNPM_VERSION}/pnpm-linux-${PNPM_ARCH}.tar.gz"; \
    echo "${PNPM_SHA256} */tmp/pnpm.tar.gz" | sha256sum -c -; \
    mkdir -p /usr/local/bin; \
    tar -xzf /tmp/pnpm.tar.gz -C /usr/local/bin pnpm; \
    chmod 755 /usr/local/bin/pnpm; \
    rm -f /tmp/pnpm.tar.gz; \
    pnpm --version;

# Runs as root: this base image installs Node system-wide (symlinked into
# /usr/bin), so ./setup needs write access there.
RUN ./setup && chown -R penpot:penpot /opt/penpot/media-processor

USER penpot:penpot

CMD ["node", "dist/index.js"]