FROM ubuntu@sha256:33ceb71981b602c1a7443a53469e4dba065f7503eab3078a2d7a57a2ab987517

ARG DEBIAN_FRONTEND=noninteractive
ARG MKOSI_COMMIT=84af20892b61c8e177e391f997ded8b4cb5514f2
ARG MKOSI_ARCHIVE_SHA256=dc45a20d3437738d7cbc8317b383ad4073d85832fad90f2793893eb6f0a433e8
ARG UBUNTU_SNAPSHOT=20260823T000000Z

# The minimal Ubuntu OCI base has no TLS trust store. Bootstrap only that trust
# store from the signed archive, then resolve and (if necessary) downgrade the
# complete final package set against the immutable snapshot.
RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates \
    && rm -rf /var/lib/apt/lists/*

RUN printf 'APT::Snapshot "%s";\n' "$UBUNTU_SNAPSHOT" \
        > /etc/apt/apt.conf.d/50dcent-snapshot \
    && apt-get update \
    && apt-get install -y --allow-downgrades --no-install-recommends \
        apt \
        binutils \
        btrfs-progs \
        bubblewrap \
        ca-certificates \
        cpio \
        cryptsetup-bin \
        curl \
        debian-archive-keyring \
        dosfstools \
        e2fsprogs \
        erofs-utils \
        fdisk \
        file \
        git \
        gnupg \
        jq \
        kmod \
        mtools \
        openssl \
        ovmf \
        parted \
        python3 \
        python3-cryptography \
        python3-dateutil \
        python3-jinja2 \
        python3-packaging \
        python3-pefile \
        python3-pyelftools \
        python3-rich \
        python3-virt-firmware \
        qemu-system-x86 \
        qemu-utils \
        sbsigntool \
        swtpm \
        systemd \
        systemd-boot-efi \
        systemd-container \
        systemd-ukify \
        tpm2-tools \
        udev \
        uidmap \
        util-linux \
        xz-utils \
        zstd \
    && rm -rf /var/lib/apt/lists/*

RUN curl --fail --location --proto '=https' --tlsv1.2 \
        "https://github.com/systemd/mkosi/archive/${MKOSI_COMMIT}.tar.gz" \
        --output /tmp/mkosi.tar.gz \
    && echo "${MKOSI_ARCHIVE_SHA256}  /tmp/mkosi.tar.gz" | sha256sum --check --strict \
    && mkdir -p /opt/mkosi \
    && tar --extract --gzip --file /tmp/mkosi.tar.gz \
        --directory /opt/mkosi --strip-components=1 \
    && rm /tmp/mkosi.tar.gz \
    && ln -s /opt/mkosi/bin/mkosi /usr/local/bin/mkosi \
    && mkosi --version \
    && test "$(mkosi --version)" = "mkosi 26"

WORKDIR /work
ENTRYPOINT ["/usr/local/bin/mkosi"]
