# A freshly installed Debian server with systemd as PID 1: the starting point of the
# ISPConfig autoinstaller (https://get.ispconfig.org). Nothing of ISPConfig is in this image.
#   docker build --build-arg BASE_IMAGE=debian:12 -t ispc3-debian12:min .
#   docker build --build-arg BASE_IMAGE=debian:13 -t ispc3-debian13:min .
ARG BASE_IMAGE=debian:12
FROM ${BASE_IMAGE}

ENV container=docker \
    DEBIAN_FRONTEND=noninteractive \
    LANG=C.UTF-8

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

# systemd and the standard tools of a hoster's Debian cloud image; everything else is
# installed by the autoinstaller
RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      systemd systemd-sysv dbus ca-certificates curl wget procps psmisc iproute2 iputils-ping \
      hostname less nano logrotate bzip2 xz-utils file lsof e2fsprogs acl attr rsync patch git \
 && rm -rf /var/lib/apt/lists/*

# Units that can not work in a container: consoles, kernel modules, remounts, time sync
# (needs CAP_SYS_TIME), quota (overlayfs and volumes have no quota) and ClamAV (about 1 GB
# of RAM for its signatures; the autoinstaller installs it, Rspamd then runs without it).
# Masking units that are installed later works as well.
RUN systemctl mask \
      getty@tty1.service console-getty.service serial-getty@.service getty.target \
      systemd-modules-load.service systemd-remount-fs.service systemd-timesyncd.service \
      systemd-udevd.service systemd-udev-trigger.service sys-kernel-config.mount sys-kernel-debug.mount \
      quotaon.service quota.service clamav-daemon.service clamav-freshclam.service \
 && systemctl set-default multi-user.target \
 && mkdir -p /etc/systemd/system/redis-server.service.d \
 && printf '%s\n' '[Service]' 'PrivateUsers=false' > /etc/systemd/system/redis-server.service.d/container.conf

# The Debian image blocks service starts in package scripts (policy-rc.d exits 101), a server
# does not. Docker bind mounts /etc/resolv.conf, so resolvconf must not replace it.
RUN rm -f /usr/sbin/policy-rc.d \
 && echo 'resolvconf resolvconf/linkify-resolvconf boolean false' | debconf-set-selections

COPY container-init /usr/local/sbin/container-init
RUN chmod 0755 /usr/local/sbin/container-init

STOPSIGNAL SIGRTMIN+3
ENTRYPOINT ["/usr/local/sbin/container-init"]
