ARG REGISTRY
ARG BASE_IMAGE
ARG HOPSWORKS_VERSION
FROM ${REGISTRY}/hopsworks-base:${BASE_IMAGE}-${HOPSWORKS_VERSION}

# Redeclared: an ARG from before the first FROM is out of scope inside the stage.
ARG IC_DIR=instantclient_12_2
ARG IC_ZIP=instantclient-basic-linux.x64-12.2.0.1.0.zip
ARG IC_URL_BASE=https://nexus.arbetsformedlingen.se/repository/aic-raw-proxy
# Kept in step with base-image/dlthub-ingestion-pipeline, which pins oracledb itself (3.4.2 at
# 5.1.0-RC0). The install treats this as a floor and leaves a newer one alone, but the default
# should still track that file so the intent is visible here.
ARG ORACLEDB_VERSION=3.4.2
# The user the finished image must run as, which is not the one these steps need. Most base images
# run as root, but spark-feature-pipeline (all versions) and agent-job (5.1) run as yarnapp, and
# ending them on root would quietly change what their workloads run as.
ARG FINAL_USER=root

USER root

# The install itself lives in install_oracle_client.sh so that this and a Hopsworks custom command
# run identical logic. Bind-mounted rather than copied, to keep it out of the image.
#
# This RUN executes in the base image's filesystem, so the CA that Kyverno mounts on the build pod
# is not visible to it and the chain has to arrive through the build context.
#
# The bundle is split before update-ca-certificates, which takes one certificate per file and
# silently ignores the rest of a concatenated one: ca-pemstore is a full bundle, so dropping it in
# whole leaves the customer chain out of the trust store and wget exits 5 on the Nexus download.
# WGET_OPTS points at the unsplit bundle as well, because that download is the one step that must
# not fail and the two mechanisms are independent.
RUN --mount=type=bind,source=install_oracle_client.sh,target=/tmp/install_oracle_client.sh \
    --mount=type=bind,source=.condarc,target=/etc/conda/.condarc \
    --mount=type=bind,source=pip.conf,target=/etc/pip.conf \
    --mount=type=bind,source=sources.list,target=/etc/apt/sources.list.d/proxy_sources.list \
    --mount=type=bind,source=ca-certificates.crt,target=/tmp/build-ca-bundle.crt \
    awk '/-----BEGIN CERTIFICATE-----/{n++} n{print > ("/usr/local/share/ca-certificates/build-ca-" n ".crt")}' \
        /tmp/build-ca-bundle.crt \
    && update-ca-certificates \
    && IC_DIR="${IC_DIR}" IC_ZIP="${IC_ZIP}" IC_URL_BASE="${IC_URL_BASE}" \
       ORACLEDB_VERSION="${ORACLEDB_VERSION}" \
       WGET_OPTS="--ca-certificate=/tmp/build-ca-bundle.crt" \
       sh /tmp/install_oracle_client.sh

# Conditional because neither 4.3 nor 5.1 ships conda: /srv/hops/anaconda holds envs/ and nothing
# else, so the unconditional call the 4.2 template used exits 127 and fails every build.
RUN if [ -x /srv/hops/anaconda/bin/conda ]; then /srv/hops/anaconda/bin/conda clean -afy; fi \
    && rm -rf ~/.cache /usr/local/share/.cache

USER ${FINAL_USER}
