Dockerfile.ubuntu.22

FROM ubuntu:22.04

LABEL org.opencontainers.image.title="gha-container-base-image" \
      org.opencontainers.image.description="Ubuntu-based github actions job container image" \
      org.opencontainers.image.documentation="https://github.com/ThoughtWorks-DPS/gha-container-base-image" \
      org.opencontainers.image.source="https://github.com/ThoughtWorks-DPS/gha-container-base-image" \
      org.opencontainers.image.url="https://github.com/ThoughtWorks-DPS/gha-container-base-image" \
      org.opencontainers.image.vendor="ThoughtWorks, Inc." \
      org.opencontainers.image.authors="nic.cheneweth@thoughtworks.com" \
      org.opencontainers.image.licenses="MIT" \
      org.opencontainers.image.created="CREATED" \
      org.opencontainers.image.version="VERSION"

SHELL ["/bin/bash", "-exo", "pipefail", "-c"]

ENV TELLER_VERSION=1.5.6
ENV DEBIAN_FRONTEND=noninteractive \
    TERM=dumb \
    PAGER=cat \
    LANG=en_US.UTF-8 \
    LANGUAGE=en_US:en \
    LC_ALL=en_US.UTF-8

# DL3008: accept unpinned versions in automated, recurring build
# SC2174: intended behavior
#
# hadolint ignore=DL3008,SC2174
RUN echo 'APT::Get::Assume-Yes "true";' > /etc/apt/apt.conf.d/90circleci && \
    echo 'DPkg::Options "--force-confnew";' >> /etc/apt/apt.conf.d/90circleci && apt-get update && \
    apt-get install --no-install-recommends -y \
            curl \
            locales \
            autoconf \
            build-essential \
            ca-certificates \
            gettext-base \
            apt-transport-https \
            lsb-release \
            libcurl4-openssl-dev \
            libssl-dev \
            software-properties-common \
            gcc \
            g++ \
            cmake \
            make \
            lsof \
            pkg-config \
            retry \
            file \
            gnupg \
            gnupg-agent \
            jq \
            tar \
            tzdata \
            unzip \
            wget \
            gzip \
            bzip2 \
            zip && \
    locale-gen en_US.UTF-8 && \
    add-apt-repository ppa:git-core/ppa && \
    curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash && \
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg && \
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null && \
    mkdir -p -m 755 /etc/apt/keyrings && \
    curl -s https://cli.github.com/packages/githubcli-archive-keyring.gpg | tee /etc/apt/keyrings/githubcli-archive-keyring.gpg > /dev/null && \
    chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg && \
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null && \
    curl -s https://apt.releases.hashicorp.com/gpg | gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg && \
    echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/hashicorp.list && apt-get update && \
    apt-get install --no-install-recommends -y \
            git \
            git-lfs \
            gh \
            vault \
            docker-ce \
            docker-ce-cli \
            containerd.io \
            docker-buildx-plugin && \
    setcap -r /usr/bin/vault && \
    ONEPASSWORD_VERSION="$(curl https://app-updates.agilebits.com/check/1/0/CLI2/en/2.0.0/N -s | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+')" && \
    curl -L "https://cache.agilebits.com/dist/1P/op2/pkg/v${ONEPASSWORD_VERSION}/op_linux_amd64_v${ONEPASSWORD_VERSION}.zip" -o op.zip && \
    unzip -o op.zip && mv op /usr/local/bin/op && \
    rm op.zip && rm op.sig && \
    curl -L "https://github.com/tellerops/teller/releases/download/v${TELLER_VERSION}/teller_${TELLER_VERSION}_Linux_x86_64.tar.gz" --output "teller_${TELLER_VERSION}_Linux_x86_64.tar.gz" && \
    tar -xzf "teller_${TELLER_VERSION}_Linux_x86_64.tar.gz" && \
    mv teller /usr/local/bin/teller && \
    rm "teller_${TELLER_VERSION}_Linux_x86_64.tar.gz" && \
    curl -L -o buildevents https://github.com/honeycombio/buildevents/releases/latest/download/buildevents-linux-amd64 && \
    chmod +x buildevents && \
    mv buildevents /usr/local/bin/buildevents && \
    mkdir /root/.gnupg && \
    bash -c "echo 'allow-loopback-pinentry' > /root/.gnupg/gpg-agent.conf" && \
    bash -c "echo 'pinentry-mode loopback' > /root/.gnupg/gpg.conf" && \
    chmod 700 /root/.gnupg && chmod 600 /root/.gnupg/* && \
    apt-get clean && rm -rf /var/lib/apt/lists/*

# easier view of key tool versions by outputing at end of build log
RUN docker --version && \
    gh --version && \
    op --version && \
    vault --version && \
    teller version && \
    buildevents -v