Containerfile

# TL npm factory builder — linux-x64, glibc (UBI8), Node 20 LTS + Go + Rust.
# Used by Konflux build-npm-package tasks; onboarder recipes run via build-npm-package.
# Keep ARG BASEIMAGE in sync with baseimage.lock.
ARG BASEIMAGE=registry.access.redhat.com/ubi8/ubi@sha256:28a85f76ad1ea0a46a81a934b02fff48d75541f77777be403d48b6bb99a363ad

FROM ${BASEIMAGE}

LABEL maintainer="Red Hat Trusted Libraries"
LABEL io.k8s.description="npm TL factory builder (Node 20, Go, Rust, glibc)"
LABEL org.opencontainers.image.source="https://github.com/calungaproject/plumbing"

ENV LC_ALL=en_US.UTF-8 \
    LANG=en_US.UTF-8 \
    LANGUAGE=en_US.UTF-8 \
    NODE_ENV=production \
    NPM_CONFIG_UPDATE_NOTIFIER=false

RUN dnf -y module enable nodejs:20 && \
    dnf -y install \
        --setopt install_weak_deps=0 \
        glibc-langpack-en \
        nodejs \
        npm \
        git \
        golang \
        python3 \
        python3-pip \
        ca-certificates \
        tar \
        gzip \
        xz \
        jq \
        which \
        findutils \
        patch \
        make \
        gcc \
        gcc-c++ \
        pkg-config \
        openssl-devel \
        && dnf clean all \
        && rm -rf /var/cache/dnf

# Rust version pin: edit rust-toolset.lock only (single source of truth).
COPY rust-toolset.lock build_scripts/install-rust-toolset.sh /tmp/
RUN chmod +x /tmp/install-rust-toolset.sh && \
    RUST_TOOLSET_LOCK=/tmp/rust-toolset.lock /tmp/install-rust-toolset.sh && \
    rm -f /tmp/install-rust-toolset.sh /tmp/rust-toolset.lock && \
    dnf clean all && \
    rm -rf /var/cache/dnf

RUN useradd -m -u 1001 -s /bin/bash builder

COPY --chmod=755 scripts/build-npm-package scripts/build-npm-packages scripts/collect-npm-artifacts scripts/npm-publish-pulp /usr/local/bin/

# rust-toolset + llvm-toolset (dependency) install under /opt/rh/* — same as `scl enable`.
ENV PATH="/opt/rh/rust-toolset/root/usr/bin:/opt/rh/llvm-toolset/root/usr/bin:/usr/local/bin:${PATH}"

WORKDIR /work
USER builder

CMD ["bash"]