Dockerfile-Alpine-3.22-Python3.12

# syntax=docker/dockerfile:1@sha256:865e5dd094beca432e8c0a1d5e1c465db5f998dca4e439981029b3b81fb39ed5

# Base image arguments
ARG ALPINE_TAG=3.20.3@sha256:1e42bbe2508154c9126d48c2b8a75420c3544343bf86fd041fb7527e017a4b4a
ARG DEBIAN_TAG=12.8-slim@sha256:ca3372ce30b03a591ec573ea975ad8b0ecaf0eb17a354416741f8001bbcae33d
ARG GOLANG_TAG=1.23.3-alpine@sha256:c694a4d291a13a9f9d94933395673494fc2cc9d4777b85df3a7e70b3492d3574

# Tool versions
ARG DEFAULT_TERRAFORM_VERSION=1.9.8
ARG DEFAULT_OPENTOFU_VERSION=1.8.6
ARG DEFAULT_CONFTEST_VERSION=0.56.0
ARG DEFAULT_TERRAGRUNT_VERSION=0.70.4

# Stage 1: Get Artifact Atlantis
FROM ghcr.io/runatlantis/atlantis:latest@sha256:f9e0b6ff14b1313b169e4ca128a578fc719745f61114e468afab0d4cbcda575e as builder
WORKDIR /atlantis/src

# Stage 2: Install Dependencies
FROM debian:${DEBIAN_TAG} AS debian-base

# Install base packages
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        ca-certificates \
        curl \
        git \
        unzip \
        openssh-server \
        dumb-init \
        gnupg \
        openssl && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

# Stage 3: Setup Dependencies
FROM debian-base AS deps

# Install git-lfs
ENV GIT_LFS_VERSION=3.6.0
ENV TARGETPLATFORM=linux/amd64
WORKDIR /tmp/build

RUN case ${TARGETPLATFORM} in \
    "linux/amd64") GIT_LFS_ARCH=amd64 ;; \
    "linux/arm64") GIT_LFS_ARCH=arm64 ;; \
    "linux/arm/v7") GIT_LFS_ARCH=arm ;; \
    esac && \
    curl -L -s --output git-lfs.tar.gz "https://github.com/git-lfs/git-lfs/releases/download/v${GIT_LFS_VERSION}/git-lfs-linux-${GIT_LFS_ARCH}-v${GIT_LFS_VERSION}.tar.gz" && \
    tar --strip-components=1 -xf git-lfs.tar.gz && \
    chmod +x git-lfs && \
    mv git-lfs /usr/bin/git-lfs && \
    git-lfs --version

# Install terraform, tofu, and terragrunt binaries
ARG DEFAULT_TERRAFORM_VERSION
ENV DEFAULT_TERRAFORM_VERSION=${DEFAULT_TERRAFORM_VERSION:-1.9.8}
ARG DEFAULT_OPENTOFU_VERSION
ENV DEFAULT_OPENTOFU_VERSION=${DEFAULT_OPENTOFU_VERSION:-1.8.6}
ARG DEFAULT_TERRAGRUNT_VERSION
ENV DEFAULT_TERRAGRUNT_VERSION=${DEFAULT_TERRAGRUNT_VERSION:-0.70.4}

COPY scripts/download-release.sh download-release.sh

# Install Terraform
RUN ./download-release.sh \
    "terraform" \
    "${TARGETPLATFORM}" \
    "${DEFAULT_TERRAFORM_VERSION}" \
    "1.6.6 1.7.5 1.8.5 ${DEFAULT_TERRAFORM_VERSION} 1.10.5 1.11.4"

# Install OpenTofu
RUN ./download-release.sh \
    "tofu" \
    "${TARGETPLATFORM}" \
    "${DEFAULT_OPENTOFU_VERSION}" \
    "${DEFAULT_OPENTOFU_VERSION}"

# Install Terragrunt (compatible with Terraform 1.9.8+)
RUN ./download-release.sh \
    "terragrunt" \
    "${TARGETPLATFORM}" \
    "${DEFAULT_TERRAGRUNT_VERSION}" \
    "${DEFAULT_TERRAGRUNT_VERSION}"

# Final Stage: Build Atlantis
FROM alpine:3.22

# Switch to root for installations
USER root

# Set locale environment variables
ENV LANG=C.UTF-8 \
    LC_ALL=C.UTF-8 \
    LANGUAGE=C.UTF-8

# Install Python 3.12, Node.js and core dependencies
RUN apk add --no-cache \
        python3=~3.12 \
        python3-dev=~3.12 \
        py3-pip \
        nodejs \
        npm \
        wget \
        curl \
        git \
        jq \
        tar \
        docker \
        docker-cli \
        gcc \
        g++ \
        make \
        cmake \
        vim \
        openssl-dev \
        libffi-dev \
        musl-dev \
        linux-headers \
        autoconf \
        zlib-dev \
        unzip \
        ca-certificates \
        gnupg \
        bash \
        shadow \
        build-base \
        pkgconfig \
        bzip2-dev \
        xz-dev \
        ncurses-dev \
        readline-dev \
        tk-dev \
        libxml2-dev \
        libxslt-dev \
        gdbm-dev \
        db-dev \
        sqlite-dev \
        dumb-init \
        aws-cli

# Create Python symlinks and install pnpm globally as root
RUN ln -sf /usr/bin/python3 /usr/bin/python && \
    ln -sf /usr/bin/pip3 /usr/bin/pip && \
    npm install -g pnpm

# Setup Docker environment
RUN mkdir -p /etc/docker && \
    echo '{"storage-driver": "overlay2", "features": {"buildkit": true}}' > /etc/docker/daemon.json && \
    mkdir -p /var/lib/docker && \
    mkdir -p /var/run/docker && \
    chmod 2777 /var/run/docker

# Create system users and groups
RUN echo "docker:x:999:" >> /etc/group && \
    mkdir -p /home/atlantis && \
    echo "atlantis:x:100:100:atlantis:/home/atlantis:/bin/bash" >> /etc/passwd && \
    echo "atlantis:x:100:" >> /etc/group && \
    sed -i 's/docker:x:999:/docker:x:999:100/' /etc/group

# Ensure proper permissions for atlantis user home directory
RUN mkdir -p /home/atlantis/.ssh /home/atlantis/.aws /home/atlantis/.local /home/atlantis/.npm \
             /home/atlantis/.docker /home/atlantis/.config /home/atlantis/.config/git \
             /home/atlantis/.pyenv /home/atlantis/.pnpm /home/atlantis/.atlantis && \
    mkdir -p /atlantis-data && \
    mkdir -p /atlantis && \
    # Set ownership for all atlantis home directory
    chown -R 100:100 /home/atlantis && \
    chown -R 100:100 /atlantis-data && \
    chown -R 100:100 /atlantis && \
    # Set proper permissions
    chmod 755 /home/atlantis && \
    chmod 700 /home/atlantis/.ssh /home/atlantis/.aws && \
    chmod 755 /home/atlantis/.local /home/atlantis/.config /home/atlantis/.config/git && \
    # Create .gitconfig with proper permissions
    touch /home/atlantis/.gitconfig && \
    chown 100:100 /home/atlantis/.gitconfig && \
    chmod 644 /home/atlantis/.gitconfig && \
    # Create .bash_profile and .bashrc with proper ownership
    touch /home/atlantis/.bash_profile /home/atlantis/.bashrc && \
    chown 100:100 /home/atlantis/.bash_profile /home/atlantis/.bashrc && \
    chmod 644 /home/atlantis/.bash_profile /home/atlantis/.bashrc

# Copy binaries and setup environment
COPY --from=builder /usr/local/bin/atlantis /usr/local/bin/atlantis
COPY --from=deps /usr/local/bin/terraform/terraform* /usr/local/bin/
COPY --from=deps /usr/local/bin/tofu/tofu* /usr/local/bin/
COPY --from=deps /usr/local/bin/terragrunt/terragrunt* /usr/local/bin/
COPY --from=deps /usr/bin/git-lfs /usr/bin/git-lfs
COPY config/docker/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh

# Set correct permissions
RUN chmod +x /usr/local/bin/docker-entrypoint.sh && \
    chmod +x /usr/local/bin/atlantis && \
    chown -R 100:100 /usr/local/bin/atlantis && \
    chmod +x /usr/local/bin/terragrunt* && \
    # Ensure atlantis user can access required directories
    mkdir -p /atlantis/config && \
    chown -R 100:100 /atlantis/config

# Copy configuration files
COPY config/docker/home /home
COPY config/docker/etc /etc
COPY config/docker/opt /opt

# Fix ownership after copying files
RUN chown -R 100:100 /home/atlantis && \
    chmod 755 /home/atlantis && \
    chmod 644 /home/atlantis/.gitconfig && \
    chmod 644 /home/atlantis/.bash_profile && \
    chmod 644 /home/atlantis/.bashrc

# Switch to atlantis user
USER 100

# Setup Node.js environment variables
ENV NODE_VERSION=20
ENV NVM_DIR="/home/atlantis/.nvm"
ENV PNPM_HOME="/home/atlantis/.local/share/pnpm"
ENV PATH="/home/atlantis/.local/bin:${PNPM_HOME}:${PATH}"

# Install Python requirements
COPY config/docker/requirements.txt ./
COPY config/docker/docker-entrypoint.sh /home/atlantis
COPY scripts/atlantis-deploy /usr/local/bin/atlantis-deploy
COPY scripts/install-atlantis-deploy /usr/local/bin/install-atlantis-deploy

# Install Python packages with break-system-packages to override PEP 668
RUN pip install --break-system-packages --upgrade pip && \
    pip install --break-system-packages -r requirements.txt

# Set the exposed port
EXPOSE ${ATLANTIS_PORT:-4141}

# Health check
HEALTHCHECK --interval=5m --timeout=3s \
    CMD curl -f http://localhost:${ATLANTIS_PORT:-4141}/healthz || exit 1

WORKDIR /home/atlantis

ENTRYPOINT ["docker-entrypoint.sh"]
CMD ["server"]