# syntax=docker/dockerfile:1.4
# Dockhand Backup Helper - Minimal restic image (Wolfi-based, zero CVEs)
#
# Rebuild trigger: the dockhand-backup-image pipeline is change-gated on this
# file. Bumping this comment forces a build so docker.io/fnsys/dockhand-backup:latest
# is (re)published to Docker Hub — the tag DEFAULT_HELPER_IMAGE (restic.ts) pulls.
# (re-triggered after fixing the ARM-builder Docker Hub login secret)
# (buildx steps consolidated into one block scalar)
# (remote ARM login: pipe password over stdin, no quoted interpolation)
# (use write-capable dockerhub token so the Docker Hub push authorizes)
# (revert rclone — the rclone: backend is unfinished/removed; see vault rclone.md)
# (rebuild: registry GC orphaned a helper-image blob; force a clean multi-arch republish)
FROM alpine:3.21 AS os-builder

ARG TARGETARCH
WORKDIR /work

ARG APKO_VERSION=0.30.34
RUN apk add --no-cache curl \
    && ARCH=$([ "$TARGETARCH" = "arm64" ] && echo "arm64" || echo "amd64") \
    && curl -sL "https://github.com/chainguard-dev/apko/releases/download/v${APKO_VERSION}/apko_${APKO_VERSION}_linux_${ARCH}.tar.gz" \
       | tar -xz --strip-components=1 -C /usr/local/bin \
    && chmod +x /usr/local/bin/apko

RUN APKO_ARCH=$([ "$TARGETARCH" = "arm64" ] && echo "aarch64" || echo "x86_64") \
    && printf '%s\n' \
    "contents:" \
    "  repositories:" \
    "    - https://packages.wolfi.dev/os" \
    "  keyring:" \
    "    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub" \
    "  packages:" \
    "    - wolfi-base" \
    "    - ca-certificates" \
    "    - busybox" \
    "    - restic" \
    "entrypoint:" \
    "  command: /bin/sh" \
    "archs:" \
    "  - ${APKO_ARCH}" \
    > apko.yaml

RUN apko build apko.yaml dockhand-backup:latest output.tar \
    && mkdir -p rootfs \
    && tar -xf output.tar \
    && LAYER=$(tar -tf output.tar | grep '.tar.gz$' | head -1) \
    && tar -xzf "$LAYER" -C rootfs

FROM scratch
COPY --from=os-builder /work/rootfs /
COPY scripts/backup-entrypoint.sh /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]