# Vulnerability Remediation (2026-06-30):
# - Go 1.26: Required by kubevirt go.work (>= 1.26.0); also used for oc, yq
# - oc release-5.1: Latest OpenShift CLI with newer dependencies
# - Fedora 45: Latest base image with updated system packages
# - yq v4.44.6: Compiled from source with Go 1.26
# - docker 7.0+: Native Unix socket support, allows requests>=2.32
# - Pinned Go modules: go-git v5.19.0, fulcio v1.8.5, sigstore v1.10.4
# - See requirements.txt and SECURITY.md for accepted risks

# oc build
FROM golang:1.26 AS oc-build
RUN apt-get update && apt-get install -y --no-install-recommends libkrb5-dev
WORKDIR /tmp
# oc build
RUN git clone --branch release-5.1 https://github.com/openshift/oc.git
WORKDIR /tmp/oc
RUN go mod edit -go 1.26 &&\
    go mod edit -require github.com/go-git/go-git/v5@v5.19.0 &&\
    go mod edit -require github.com/go-git/go-billy/v5@v5.9.0 &&\
    go mod edit -require go.opentelemetry.io/otel@v1.41.0 &&\
    go mod edit -require github.com/moby/spdystream@v0.5.1 &&\
    go mod edit -require golang.org/x/net@v0.38.0 &&\
    go mod edit -require github.com/Azure/go-ntlmssp@v0.1.1 &&\
    go mod edit -require github.com/sigstore/fulcio@v1.8.5 &&\
    go mod edit -require github.com/sigstore/sigstore@v1.10.4 &&\
    go mod edit -replace golang.org/x/net=golang.org/x/net@v0.38.0 &&\
    go mod edit -replace github.com/moby/spdystream=github.com/moby/spdystream@v0.5.1 &&\
    go mod edit -replace github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream=github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.8 &&\
    go mod edit -replace github.com/aws/aws-sdk-go-v2/service/s3=github.com/aws/aws-sdk-go-v2/service/s3@v1.97.3 &&\
    go mod tidy && \
    rm -rf vendor && \
    go mod vendor

RUN make GO_REQUIRED_MIN_VERSION:= oc

# virtctl build
WORKDIR /tmp
RUN git clone https://github.com/kubevirt/kubevirt.git
WORKDIR /tmp/kubevirt
RUN go mod edit -go 1.26 &&\
    go mod edit -replace github.com/moby/spdystream=github.com/moby/spdystream@v0.5.1 &&\
    go mod edit -replace github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream=github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.8 &&\
    go mod edit -replace github.com/aws/aws-sdk-go-v2/service/s3=github.com/aws/aws-sdk-go-v2/service/s3@v1.97.3 &&\
    go work edit -go 1.26 &&\
    go mod tidy &&\
    go work use &&\
    go work vendor &&\
    go build -o virtctl ./cmd/virtctl/

# yq build
WORKDIR /tmp
RUN git clone --depth 1 --branch v4.44.6 https://github.com/mikefarah/yq.git
WORKDIR /tmp/yq
RUN go mod edit -replace golang.org/x/net=golang.org/x/net@v0.38.0 &&\
    go mod edit -replace github.com/moby/spdystream=github.com/moby/spdystream@v0.5.1 &&\
    go mod tidy &&\
    go build -ldflags="-s -w" .

FROM fedora:45
ARG PR_NUMBER
ARG TAG
ARG PYTHON_VERSION=3.11
ENV PYTHON_CMD=python${PYTHON_VERSION}
RUN groupadd -g 1001 krkn && useradd -m -u 1001 -g krkn krkn
RUN dnf update -y

ENV KUBECONFIG /home/krkn/.kube/config


# This overwrites any existing configuration in /etc/yum.repos.d/kubernetes.repo
RUN dnf update && dnf install -y --setopt=install_weak_deps=False \
    git python${PYTHON_VERSION} jq gettext wget which ipmitool openssh-server &&\
    dnf clean all

# copy oc, virtctl, yq binaries from oc-build image
COPY --from=oc-build /tmp/oc/oc /usr/bin/oc
COPY --from=oc-build /tmp/kubevirt/virtctl /usr/bin/virtctl
COPY --from=oc-build /tmp/yq/yq /usr/bin/yq
RUN ln -s /usr/bin/oc /usr/bin/kubectl

# krkn build
RUN git clone https://github.com/krkn-chaos/krkn.git /home/krkn/kraken && \
    mkdir -p /home/krkn/.kube

RUN mkdir -p /home/krkn/.ssh && \
    chmod 700 /home/krkn/.ssh

WORKDIR /home/krkn/kraken

# default behaviour will be to build main
# if it is a PR trigger the PR itself will be checked out
RUN if [ -n "$PR_NUMBER" ]; then git fetch origin pull/${PR_NUMBER}/head:pr-${PR_NUMBER} && git checkout pr-${PR_NUMBER};fi
# if it is a TAG trigger checkout the tag
RUN if [ -n "$TAG" ]; then git checkout "$TAG";fi

RUN ${PYTHON_CMD} -m ensurepip --upgrade --default-pip
RUN ${PYTHON_CMD} -m pip install --upgrade pip setuptools==81.0.0

# removes the the vulnerable versions of setuptools and pip
RUN rm -rf "$(pip cache dir)"
RUN rm -rf /tmp/*
RUN rm -rf /usr/local/lib/${PYTHON_CMD}/ensurepip/_bundled
RUN ${PYTHON_CMD} -m pip install --no-build-isolation -r requirements.txt
RUN ${PYTHON_CMD} -m pip install jsonschema
# Force setuptools==81.0.0 after all deps (some may try to upgrade it to 82+)
RUN ${PYTHON_CMD} -m pip install --force-reinstall --no-deps setuptools==81.0.0

LABEL krknctl.title.global="Krkn Base Image"
LABEL krknctl.description.global="This is the krkn base image."
LABEL krknctl.input_fields.global='$KRKNCTL_INPUT'

# SSH setup script
RUN chmod +x /home/krkn/kraken/containers/setup-ssh.sh

# Main entrypoint script
RUN chmod +x /home/krkn/kraken/containers/entrypoint.sh

RUN chown -R krkn:krkn /home/krkn && chmod 755 /home/krkn
USER krkn

ENTRYPOINT ["/bin/bash", "/home/krkn/kraken/containers/entrypoint.sh"]
CMD ["--config=config/config.yaml"]