Dockerfile.centos

# CentOS 7.9 has glibc 2.17
FROM public.ecr.aws/docker/library/centos:centos7.9.2009

# Set yum vault
RUN <<SHELL
set -eux

if [ "$(uname -m)" != "x86_64" ]; then
    repo_version="altarch/7.9.2009"
else
    repo_version="7.9.2009"
fi

cat <<EOF > /etc/yum.repos.d/CentOS-Base.repo
[base]
name=CentOS-\$releasever - Base
baseurl=http://vault.centos.org/${repo_version}/os/\$basearch/
gpgcheck=0

[updates]
name=CentOS-\$releasever - Updates
baseurl=http://vault.centos.org/${repo_version}/updates/\$basearch/
gpgcheck=0

[extras]
name=CentOS-\$releasever - Extras
baseurl=http://vault.centos.org/${repo_version}/extras/\$basearch/
gpgcheck=0

[centosplus]
name=CentOS-\$releasever - Plus
baseurl=http://vault.centos.org/${repo_version}/centosplus/\$basearch/
gpgcheck=0
enabled=0
EOF
SHELL

# A few RUN actions in Dockerfiles are subject to uncontrollable outside
# variability: an identical command would be the same from `docker build`'s
# point of view but does not indicate the result would be identical at
# different points in time.
#
# This causes two possible issues:
#
# - one wants to capture a new state and so wants the identical
#   non-reproducible command to produce a new result. This could be achieved
#   with --no-cache but this affects every single operation in a Dockerfile
# - one wants to identify a specific state and leverage caching at that
#   specific state.
#
# To that end a BUILD_ARG is introduced to capture an arbitrary identifier of
# that state (typically time) that is introduced in non-reproducible commands
# to make them appear different to Docker.
#
# Of course it only works when caching data is available: two independent
# builds with the same value and no cache shared would produce different
# results.
ARG REPRO_RUN_KEY=0

# `yum` db fetching is uncontrolled and fetches whatever is today's index.
# For the sake of reproducibility subsequent steps (including in dependent
# images) should not perform `yum` db cache updates, instead this base image
# should be updated by changing the `REPRO_RUN_KEY`.
RUN true "${REPRO_RUN_KEY}" && yum makecache -y

# localedef has been forcefully removed by:
# rm -rf "$target"/usr/{{lib,share}/locale,{lib,lib64}/gconv,bin/localedef,sbin/build-locale-archive}
# fun: CentOS 8 has `yum list glibc-langpack-\*` but not CentOS 7 :'(
RUN yum reinstall -y glibc-common

RUN yum install -y curl gcc gcc-c++ gettext make patchutils patch libtool pkgconfig gettext file zip unzip git

# fun: this has to be after `yum install curl gcc make`... but only on aarch64; go figure
# extra fun: table is botched, localedef not happy, swallow result and test `locale` for errors
RUN <<SHELL
localedef -v -c -i en_US -f UTF-8 en_US.UTF-8 || true
if locale 2>&1 | grep -e 'locale: Cannot set LC_.* to default locale: No such file or directory'; then exit 1; fi
SHELL

# Skip installing gem documentation
COPY <<GEMRC /usr/local/etc/gemrc
install: --no-document
update: --no-document
GEMRC

ENV LANG="en_US.UTF-8"                                                                      \
    RUBY_MAJOR="2.1"                                                                        \
    RUBY_VERSION="2.1.10"                                                                   \
    RUBY_DOWNLOAD_SHA256="5be9f8d5d29d252cd7f969ab7550e31bbb001feb4a83532301c0dd3b5006e148"

# - Compile Ruby with `--disable-shared`
# - Update gem version

RUN <<SHELL
set -eux

yum install -y xz gcc automake bison zlib-devel libyaml-devel openssl-devel gdbm-devel readline-devel ncurses-devel libffi-devel

curl -o ruby.tar.xz "https://cache.ruby-lang.org/pub/ruby/${RUBY_MAJOR%-rc}/ruby-$RUBY_VERSION.tar.xz"
echo "$RUBY_DOWNLOAD_SHA256 *ruby.tar.xz" | sha256sum --check --strict
mkdir -p /usr/src/ruby
tar -xJf ruby.tar.xz -C /usr/src/ruby --strip-components=1
rm ruby.tar.xz

cd /usr/src/ruby

# hack in "ENABLE_PATH_CHECK" disabling to suppress:
#   warning: Insecure world writable dir
{
    echo '#define ENABLE_PATH_CHECK 0'
    echo
    cat file.c
} > file.c.new
mv file.c.new file.c

autoconf

gnuArch="$(gcc -dumpmachine)"
./configure \
    --build="$gnuArch" \
    --disable-install-doc \
    --disable-shared
make -j "$(nproc)"
make install

# 	find /usr/local -type f -executable -not \( -name '*tkinter*' \) -exec ldd '{}' ';' \
# 		| awk '/=>/ { print $(NF-1) }' \
# 		| sort -u \
# 		| grep -vE '^/usr/local/lib/' \
# 		| xargs -r dpkg-query --search \
# 		| cut -d: -f1 \
# 		| sort -u \
# 		| xargs -r apt-mark manual \
#
# 	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
#
# find /usr/local -type f -executable -not \( -name '*tkinter*' \) -exec ldd '{}' ';' \
#       | awk '/=>/ { print $(NF-1) }' \
#       | grep -v '=>' \
#       | sort -u \
#       | grep -vE '^/usr/local/lib/' \
#       | xargs -r rpm -qf \
#       | sort -u \
#       | xargs -r yum ?mark-manual?
#
# yum autoremove -y
# yum remove --setopt=clean_requirements_on_remove=1
# package-cleanup --leaves && yum autoremove # yum-utils
# sudo yum history list pdftk
# sudo yum history undo 88

cd /
rm -r /usr/src/ruby
if yum list installed ruby; then exit 1; fi

# update gem version
gem update --system 2.7.11
gem install bundler --version 1.17.3 --force

# rough smoke test
ruby --version
gem --version
bundle --version

SHELL

# don't create ".bundle" in all our apps
ENV GEM_HOME=/usr/local/bundle
ENV BUNDLE_SILENCE_ROOT_WARNING=1 \
    BUNDLE_APP_CONFIG="$GEM_HOME"
ENV PATH=$GEM_HOME/bin:$PATH

# adjust permissions of a few directories for running "gem install" as an arbitrary user
RUN mkdir -p "$GEM_HOME" && chmod 1777 "$GEM_HOME"

CMD [ "irb" ]