FROM ubuntu:24.04

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

ENV DEBIAN_FRONTEND=noninteractive \
    TZ=Etc/UTC \
    LC_ALL=C.UTF-8 \
    LANG=C.UTF-8

RUN set -euxo pipefail; \
    for i in 1 2 3; do \
      apt-get update && \
      apt-get install -y --no-install-recommends ca-certificates && \
      update-ca-certificates && break || { \
        echo "[apt] ca-certificates bootstrap attempt $i failed, retrying..."; \
        apt-get clean; rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/partial/*; \
        sleep $((i*2)); \
      }; \
    done

RUN set -euxo pipefail; \
    # Disable default sources and write a clean sources.list, selecting the right mirror for the architecture
    rm -f /etc/apt/sources.list; \
    rm -f /etc/apt/sources.list.d/* || true; \
    arch="$(dpkg --print-architecture)"; \
    if [[ "$arch" == "arm64" || "$arch" == "armhf" ]]; then \
      printf '%s\n' \
        'deb https://ports.ubuntu.com/ubuntu-ports noble main restricted universe multiverse' \
        'deb https://ports.ubuntu.com/ubuntu-ports noble-updates main restricted universe multiverse' \
        'deb https://ports.ubuntu.com/ubuntu-ports noble-security main restricted universe multiverse' \
        'deb https://ports.ubuntu.com/ubuntu-ports noble-backports main restricted universe multiverse' \
        > /etc/apt/sources.list; \
    else \
      printf '%s\n' \
        'deb https://archive.ubuntu.com/ubuntu noble main restricted universe multiverse' \
        'deb https://archive.ubuntu.com/ubuntu noble-updates main restricted universe multiverse' \
        'deb https://security.ubuntu.com/ubuntu noble-security main restricted universe multiverse' \
        'deb https://archive.ubuntu.com/ubuntu noble-backports main restricted universe multiverse' \
        > /etc/apt/sources.list; \
    fi

RUN set -euxo pipefail; \
    # Harden apt behavior
    echo 'Acquire::Retries "5";' > /etc/apt/apt.conf.d/80-retries; \
    echo 'Acquire::http::No-Cache "true"; Acquire::https::No-Cache "true";' > /etc/apt/apt.conf.d/99-no-cache; \
    echo 'Acquire::By-Hash "yes";' > /etc/apt/apt.conf.d/99-by-hash; \
    echo 'Acquire::ForceIPv4 "true";' > /etc/apt/apt.conf.d/99-ipv4; \
    # Install build dependencies with retries
    for i in 1 2 3 4 5; do \
      apt-get update && \
      apt-get -y dist-upgrade && \
      apt-get install -y --no-install-recommends \
        build-essential \
        ccache \
        cmake \
        ninja-build \
        pkg-config \
        git \
        curl \
        jq \
        zip \
        unzip \
        tar \
        libkrb5-3 \
        libssl-dev \
        libsqlite3-dev \
        libncurses-dev \
        protobuf-compiler \
        meson \
        python3 \
        python3-pip \
        python3-venv && break; \
      echo "[apt] install attempt $i failed, retrying..."; \
      apt-get clean; rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/partial/*; \
      sleep $((i*2)); \
    done; \
    command -v python3 >/dev/null && command -v cmake >/dev/null && command -v git >/dev/null || { echo "[apt] install failed after retries"; exit 1; }; \
    python3 -m venv /opt/venv; \
    /opt/venv/bin/pip install --no-cache-dir "conan<3"; \
    apt-get clean; rm -rf /var/lib/apt/lists/*

# Ensure venv tools (including conan) are on PATH
ENV PATH="/opt/venv/bin:${PATH}"

WORKDIR /work

# Quick sanity check of core tools
RUN echo "gcc: $(gcc --version | head -n1)" && \
    echo "cmake: $(cmake --version | head -n1)" && \
    echo "ninja: $(ninja --version || true)" && \
    echo "git: $(git --version)" && \
    echo "conan: $(conan --version)" && \
    echo "ccache: $(ccache --version | head -n1)"