java25.dockerfile

# syntax=docker/dockerfile:1

# ======================================================================
# Wafer-Weave base image: OpenJDK 25 (LTS) + Maven for dev
# Image tag: ww-java25-dev:0.1
#
# Mirrors the conventions of docker/py314.dockerfile on purpose: same user
# (alab, home /local), same workdir (/work), same zsh/oh-my-zsh skel + entrypoint.
#
# Unlike the Python image there is no need to build from source, so the JDK is
# taken from the official Eclipse Temurin image and Maven from the Apache
# archive with a pinned checksum.
#
# Cross-architecture (same as the Python image):
#   docker buildx build --platform linux/arm64 -f docker/java25.dockerfile \
#     -t ww-java25-dev:0.1 docker/
#   docker buildx build --platform linux/amd64 -f docker/java25.dockerfile \
#     -t ww-java25-dev:0.1-amd64 docker/
# ======================================================================

# ---- pinned versions (reproducibility) -------------------------------
ARG DEBIAN_BASE=debian:bookworm-slim
ARG JDK_IMAGE=eclipse-temurin:25-jdk
ARG MAVEN_VERSION=3.9.16
# SHA512 published by Apache alongside the binary tarball:
#   https://downloads.apache.org/maven/maven-3/3.9.16/binaries/apache-maven-3.9.16-bin.tar.gz.sha512
ARG MAVEN_SHA512=831a8591fe20c8243b1dbe7d71e3244f31d1665b0804b2e825e38cbbe5ce0cafb8338851f90780735568773e0a6cd07bbec107cda0b896b008b861075358b6f6

# ======================================================================
# Stage 1: jdk — official Temurin build, used only as a source to copy from
# ======================================================================
FROM ${JDK_IMAGE} AS jdk

# ======================================================================
# Stage 2: base — runtime image
# ======================================================================
FROM ${DEBIAN_BASE} AS base

ARG TARGETPLATFORM
ARG TARGETARCH
ARG MAVEN_VERSION
ARG MAVEN_SHA512
ARG INSTALL_OHMYZSH=true

LABEL maintainer="alex-laban" \
      org.opencontainers.image.title="ww-java25-dev" \
      org.opencontainers.image.description="Wafer-Weave OpenJDK 25 + Maven dev base" \
      org.opencontainers.image.architecture="${TARGETARCH}"

ENV TZ=US/Pacific \
    DEBIAN_FRONTEND=noninteractive \
    JAVA_HOME=/opt/java/openjdk \
    MAVEN_HOME=/opt/maven \
    PATH=/opt/java/openjdk/bin:/opt/maven/bin:/local/.local/bin:$PATH

RUN echo "Building for platform=${TARGETPLATFORM} arch=${TARGETARCH}"

# Dev CLI toolchain (same set as the Python base, minus Python-specific libs).
RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      apt-transport-https \
      ca-certificates \
      gnupg \
      lsb-release \
      sudo \
      git \
      curl \
      wget \
      vim \
      nano \
      mc \
      openssh-client \
      zsh \
      pandoc \
 && rm -rf /var/lib/apt/lists/*

# JDK 25 from the official Temurin image (it lives at /opt/java/openjdk there).
COPY --from=jdk /opt/java/openjdk /opt/java/openjdk

# Maven, pinned + checksum-verified against the Apache archive (archive.apache.org
# keeps every release permanently; downloads.apache.org only keeps the current one).
RUN wget -q "https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz" \
 && echo "${MAVEN_SHA512}  apache-maven-${MAVEN_VERSION}-bin.tar.gz" | sha512sum -c - \
 && tar -xzf "apache-maven-${MAVEN_VERSION}-bin.tar.gz" -C /opt \
 && mv "/opt/apache-maven-${MAVEN_VERSION}" /opt/maven \
 && rm "apache-maven-${MAVEN_VERSION}-bin.tar.gz"

# Verify the toolchain before baking the rest of the image.
RUN java -version && mvn -version

# ---- user: alab, home /local, zsh shell (same as the Python base) ----
# secure_path MUST include the JDK and Maven bins, otherwise sudo (used by the
# entrypoint to drop privileges) resets PATH and hides java/mvn.
RUN adduser --disabled-password --gecos "" --shell /bin/zsh --home /local alab \
 && echo "alab:test" | chpasswd \
 && adduser alab sudo \
 && echo '%sudo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers \
 && echo 'Defaults secure_path="/opt/java/openjdk/bin:/opt/maven/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"' >> /etc/sudoers \
 && echo 'Defaults env_keep += "JAVA_HOME MAVEN_HOME TZ"' >> /etc/sudoers

# ZSH tooling (oh-my-zsh installer is version-pinned -> reproducible).
RUN if [ "${INSTALL_OHMYZSH}" = "true" ]; then \
        sh -c "$(wget -O- https://github.com/deluan/zsh-in-docker/releases/download/v1.1.5/zsh-in-docker.sh)" -- -t robbyrussell || true; \
    fi

# Stage a COMPLETE oh-my-zsh (zsh-in-docker installs the framework into /root)
# plus our ys theme under /opt/ww-skel. Staged here, not /local, because /local
# may be a mounted volume at runtime; the entrypoint / devcontainer hook seeds
# it in. Copying the framework is required — without it .zshrc's
# `source $ZSH/oh-my-zsh.sh` fails and the ys prompt never loads.
RUN mkdir -p /opt/ww-skel \
 && if [ -d /root/.oh-my-zsh ]; then cp -a /root/.oh-my-zsh /opt/ww-skel/.oh-my-zsh; fi \
 && mkdir -p /opt/ww-skel/.oh-my-zsh/custom/themes \
 && tee /opt/ww-skel/.oh-my-zsh/custom/themes/ys.zsh-theme > /dev/null <<'EOF'
# ys theme - minimal prompt
PROMPT='%F{cyan}%n@%m %F{yellow}%~ %F{green}%(!.#.$) %f'
RPROMPT='%F{blue}%*%f'
EOF

RUN tee /opt/ww-skel/.zshrc > /dev/null <<'EOF'
export ZSH="$HOME/.oh-my-zsh"
ZSH_THEME="ys"
plugins=(aliases git docker kubectl mvn)
source $ZSH/oh-my-zsh.sh
EOF

RUN chmod -R a+r /opt/ww-skel

# Entrypoint: seed skel into the (possibly mounted) home, then drop to alab.
RUN mkdir -p /usr/local/bin
RUN tee /usr/local/bin/ww-entrypoint.sh > /dev/null <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
# If /local (home) is missing or missing oh-my-zsh, copy defaults from /opt/ww-skel
if [ ! -d /local ]; then
    mkdir -p /local
fi
if [ ! -e /local/.oh-my-zsh ]; then
    cp -a /opt/ww-skel/.oh-my-zsh /local/ || true
fi
if [ ! -e /local/.zshrc ]; then
    cp -a /opt/ww-skel/.zshrc /local/.zshrc || true
fi
# Ensure ownership for alab
chown -R alab:alab /local || true
# Start the requested command as alab. -H sets HOME=/local; PATH comes from
# sudo secure_path (includes the JDK/Maven bins).
if [ "$#" -gt 0 ]; then
    exec sudo -H -u alab -- "$@"
else
    exec sudo -H -u alab -- zsh
fi
EOF
RUN chmod +x /usr/local/bin/ww-entrypoint.sh

# Workdir (kept empty at build time in case it's an external volume at runtime).
RUN mkdir -p /work && chown alab:alab /work || true
WORKDIR /work

ENTRYPOINT ["/usr/local/bin/ww-entrypoint.sh"]
CMD ["zsh"]