Dockerfile.template

{{
	def is_alpine:
		env.variant | startswith("alpine")
-}}
{{ if is_alpine then ( -}}
FROM ruby:{{ .ruby.version }}-{{ env.variant }}
{{ ) else ( -}}
FROM ruby:{{ .ruby.version }}-slim-{{ env.variant }}
{{ ) end -}}

# explicitly set uid/gid to guarantee that it won't change in the future
# the values 999:999 are identical to the current user/group id assigned
{{ if is_alpine then ( -}}
# alpine already has a gid 999, so we'll use the next id
RUN addgroup -S -g 1000 redmine && adduser -S -H -G redmine -u 999 redmine
{{ ) else ( -}}
RUN groupadd -r -g 999 redmine && useradd -r -g redmine -u 999 redmine
{{ ) end -}}

{{
	[
		# common packages
		"ca-certificates",
		"ghostscript", # for creating PDF thumbnails
		"git",
		"imagemagick",
		"mercurial",
		"openssh-client",
		"subversion",
		"tini", # grab tini for signal processing and zombie killing
		"wget",
		if is_alpine then
			# alpine packages
			"bash",
			"breezy",
			"findutils",
			"ghostscript-fonts",  # for generating PNGs of Gantt charts
			"tzdata",
			empty
		else
			# debian packages
			"bzr",
			"gsfonts", # for generating PNGs of Gantt charts
			empty
		end
	] | sort | (
-}}
RUN set -eux; \
{{ if is_alpine then ( -}}
	apk add --no-cache \
{{ map( -}}
		{{ . }} \
{{ ) | add -}}
	;
{{ ) else ( -}}
	apt-get update; \
	apt-get install -y --no-install-recommends \
{{ map( -}}
		{{ . }} \
{{ ) | add -}}
	; \
{{ if env.variant == "bookworm" then ( -}}
# allow imagemagick to use ghostscript for PDF -> PNG thumbnail conversion (4.1+)
	sed -ri 's/(rights)="none" (pattern="PDF")/\1="read" \2/' /etc/ImageMagick-6/policy.xml; \
{{ ) else "" end -}}
	rm -rf /var/lib/apt/lists/*
{{ ) end -}}
{{ ) -}}

# grab gosu for easy step-down from root
# https://github.com/tianon/gosu/releases
ENV GOSU_VERSION 1.19
RUN set -eux; \
	\
{{ if is_alpine then ( -}}
	apk add --no-cache --virtual .gosu-deps \
		dpkg \
		gnupg \
	; \
{{ ) else ( -}}
	savedAptMark="$(apt-mark showmanual)"; \
	apt-get update; \
	apt-get install -y --no-install-recommends \
		gnupg \
	; \
	rm -rf /var/lib/apt/lists/*; \
{{ ) end -}}
	\
	dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \
	wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch"; \
	wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch.asc"; \
	export GNUPGHOME="$(mktemp -d)"; \
	gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \
	gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \
	gpgconf --kill all; \
	rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \
	\
{{ if is_alpine then ( -}}
	apk del --no-network .gosu-deps; \
{{ ) else ( -}}
	apt-mark auto '.*' > /dev/null; \
	apt-mark manual $savedAptMark > /dev/null; \
	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
{{ ) end -}}
	\
# smoke test
	chmod +x /usr/local/bin/gosu; \
	gosu --version; \
	gosu nobody true

ENV RAILS_ENV production
WORKDIR /usr/src/redmine

# https://github.com/docker-library/redmine/issues/138#issuecomment-438834176
# (bundler needs this for running as an arbitrary user)
ENV HOME /home/redmine
RUN set -eux; \
	[ ! -d "$HOME" ]; \
	mkdir -p "$HOME"; \
	chown redmine:redmine "$HOME"; \
	chmod 1777 "$HOME"

ENV REDMINE_VERSION {{ .version }}
ENV REDMINE_DOWNLOAD_URL {{ .downloadUrl }}
ENV REDMINE_DOWNLOAD_SHA256 {{ .sha256 }}
ENV RAILS_LOG_TO_STDOUT true

RUN set -eux; \
	wget -O redmine.tar.gz "$REDMINE_DOWNLOAD_URL"; \
	echo "$REDMINE_DOWNLOAD_SHA256 *redmine.tar.gz" | sha256sum -c -; \
	tar -xf redmine.tar.gz --strip-components=1; \
	rm redmine.tar.gz files/delete.me log/delete.me; \
	# https://www.redmine.org/projects/redmine/wiki/RedmineInstall#Step-8-File-system-permissions
	set -- {{
		[
			"config",   # database.yml created by the entrypoint and secret_token.rb if not using SECRET_KEY_BASE
			"db",       # schema.rb is created/edited during 'rake db:migrate'
			"sqlite",   # database dir when using sqlite
			"tmp/pids", # pid file location

			# from RedmineInstall instructions
			"log",
			"tmp",
			"tmp/pdf",
			"public/assets",
			empty
			| @sh
		]
		| sort
		| join(" ")
	}}; \
	mkdir -p "$@"; \
	chown -R redmine:redmine ./; \
# fix permissions for running as an arbitrary user
	chmod -R ugo=rwX "$@"; \
	find "$@" -type d -exec chmod 1777 '{}' +

{{ if is_alpine and IN(env.version; "6.0") then ( -}}
# build for musl-libc, not glibc (see https://github.com/sparklemotion/nokogiri/issues/2075, https://github.com/rubygems/rubygems/issues/3174)
ENV BUNDLE_FORCE_RUBY_PLATFORM 1
{{ ) else "" end -}}
{{
	[
		# common packages
		"freetds-dev",
		"gcc",
		"make",
		"patch",
		if is_alpine then
			# alpine packages
			"coreutils", # required because "chmod +X" in busybox will remove +x on files (and coreutils leaves files alone with +X)
			"mariadb-dev",
			"musl-dev",
			"postgresql-dev",
			"yaml-dev",
			if IN(env.version; "6.0") then
				"sqlite-dev",
				"ttf2ufm",
				"zlib-dev",
				empty
			else
				# 6.1+ needs to compile some extensions on non-amd64-non-arm64 architectures
				"cargo",
				"clang19-dev", # TODO the dep needing libclang.so doesn't seem to care what version, so maybe there's a more generic dep we could use here?
				empty
			end,
			empty
		else
			# debian packages
			"default-libmysqlclient-dev",
			"libpq-dev",
			"libsqlite3-dev",
			"libxml2-dev",
			"libxslt-dev",
			"libyaml-dev",
			"pkgconf",
			"xz-utils",
			if IN(env.version; "6.0") then empty else
				# 6.1+ needs to compile some extensions on non-amd64-non-arm64 architectures
				"cargo",
				"libclang-dev",
				empty
			end,
			empty
		end
	] | sort | (
-}}
RUN set -eux; \
{{ if is_alpine then ( -}}
	apk add --no-cache --virtual .build-deps \
{{ map( -}}
		{{ . }} \
{{ ) | add -}}
	; \
{{ ) else ( -}}
	savedAptMark="$(apt-mark showmanual)"; \
	apt-get update; \
	apt-get install -y --no-install-recommends \
{{ map( -}}
		{{ . }} \
{{ ) | add -}}
	; \
	rm -rf /var/lib/apt/lists/*; \
{{ ) end -}}
{{ ) -}}
	\
	gosu redmine bundle config --local without 'development test'; \
# https://github.com/redmine/redmine/commit/23dc108e70a0794f444803ac827a690085dcd557
# ("gem puma" already exists in the Gemfile, but under "group :test" and we want it all the time)
	puma="$(grep -E "^[[:space:]]*gem [:'\"]puma['\",[:space:]].*\$" Gemfile)"; \
	{ echo; echo "$puma"; } | sed -re 's/^[[:space:]]+//' >> Gemfile; \
# fill up "database.yml" with bogus entries so the redmine Gemfile will pre-install all database adapter dependencies
# https://github.com/redmine/redmine/blob/e9f9767089a4e3efbd73c35fc55c5c7eb85dd7d3/Gemfile#L50-L79
	echo '# the following entries only exist to force `bundle install` to pre-install all database adapter dependencies -- they can be safely removed/ignored' > ./config/database.yml; \
	for adapter in mysql2 postgresql sqlserver sqlite3; do \
		echo "$adapter:" >> ./config/database.yml; \
		echo "  adapter: $adapter" >> ./config/database.yml; \
	done; \
{{ if is_alpine then "" else ( -}}
# nokogiri's vendored libxml2 + libxslt do not build on mips64le, so use the apt packages when building
	gosu redmine bundle config build.nokogiri --use-system-libraries; \
{{ ) end -}}
	gosu redmine bundle install --jobs "$(nproc)"; \
	rm ./config/database.yml; \
# fix permissions for running as an arbitrary user
	chmod -R ugo=rwX Gemfile.lock "$GEM_HOME"; \
	rm -rf ~redmine/.bundle; \
	\
{{ if is_alpine then ( -}}
# https://github.com/naitoh/rbpdf/issues/31
	rm /usr/local/bundle/gems/rbpdf-font-1.19.*/lib/fonts/ttf2ufm/ttf2ufm; \
	\
	runDeps="$( \
		scanelf --needed --nobanner --format '%n#p' --recursive /usr/local/bundle/gems \
		| tr ',' '\n' \
		| sort -u \
		| awk ' \
{{ if IN(env.version; "6.0") then "" else ( -}}
			$1 == "libc.so" { next } \
{{ ) end -}}
			system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } \
			{ print "so:" $1 } \
		' \
	)"; \
	apk add --no-network --virtual .redmine-rundeps $runDeps; \
	apk del --no-network .build-deps
{{ ) else ( -}}
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
	apt-mark auto '.*' > /dev/null; \
	[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
	find /usr/local -type f -executable -exec ldd '{}' ';' \
		| awk '/=>/ { so = $(NF-1); if (index(so, "/usr/local/") == 1) { next }; gsub("^/(usr/)?", "", so); printf "*%s\n", so }' \
		| sort -u \
		| xargs -rt dpkg-query --search \
# https://manpages.debian.org/trixie/dpkg/dpkg-query.1.en.html#S (we ignore diversions and it'll be really unusual for more than one package to provide any given .so file)
		| awk 'sub(":$", "", $1) { print $1 }' \
		| sort -u \
		| xargs -r apt-mark manual \
	; \
	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
{{ ) end -}}

VOLUME /usr/src/redmine/files

COPY docker-entrypoint.sh /
ENTRYPOINT ["/docker-entrypoint.sh"]

EXPOSE 3000
CMD ["rails", "server", "-b", "0.0.0.0"]