# syntax=docker/dockerfile:1

# ---- build stage: fetch + verify + unzip PocketBase ----
FROM alpine:3.22 AS build

ARG PB_VERSION=0.39.7
# provided automatically by buildx (e.g. amd64, arm64)
ARG TARGETARCH

RUN apk add --no-cache unzip ca-certificates

# download the release zip and its checksums file
ADD https://github.com/pocketbase/pocketbase/releases/download/v${PB_VERSION}/pocketbase_${PB_VERSION}_linux_${TARGETARCH}.zip /tmp/pb.zip
ADD https://github.com/pocketbase/pocketbase/releases/download/v${PB_VERSION}/checksums.txt /tmp/pb_checksums.txt

# verify integrity against the published checksums, then unzip
RUN grep "pocketbase_${PB_VERSION}_linux_${TARGETARCH}.zip" /tmp/pb_checksums.txt \
      | sed "s#pocketbase_${PB_VERSION}_linux_${TARGETARCH}.zip#/tmp/pb.zip#" \
      | sha256sum -c - \
    && unzip /tmp/pb.zip -d /pb/

# ---- runtime stage: minimal image with just the binary ----
# NOTE: this variant runs PocketBase as root (no dedicated user / USER directive).
FROM alpine:3.22

# ca-certificates: outbound TLS (e.g. OAuth, mailer)
# sqlite: used by the entrypoint to check whether the superuser already exists
RUN apk add --no-cache ca-certificates sqlite \
    && mkdir -p /pb/pb_data

COPY --from=build /pb/pocketbase /pb/pocketbase
COPY --chmod=0755 entrypoint.root.sh /pb/entrypoint.root.sh

# uncomment to copy the local pb_migrations dir into the image
# COPY ./pb_migrations /pb/pb_migrations

# uncomment to copy the local pb_hooks dir into the image
# COPY ./pb_hooks /pb/pb_hooks

# persist the SQLite database and uploaded files across container recreations
VOLUME /pb/pb_data

# default listen port; override at runtime with -e PB_PORT=...
ENV PB_PORT=8070
EXPOSE 8070

# shell form so ${PB_PORT} is expanded from the runtime environment
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
    CMD wget -qO- "http://127.0.0.1:${PB_PORT}/api/health" || exit 1

# runs as root (default user — no USER directive)
# entrypoint handles superuser bootstrap + encryption, then execs `serve`
ENTRYPOINT ["/pb/entrypoint.root.sh"]