FROM docker.io/alpine:3.15.0

# > $ grep -azoP -- '\-+BEGIN CERTIFICATE\-+[\sa-zA-Z0-9\+/]+\=*\s\-+END CERTIFICATE\-+\s' \
# >   /usr/local/bin/toit | openssl x509 -noout -serial -subject -issuer -dates -fingerprint
# > serial=02008EB2023336658B64CDDB9B
# > subject=C = US, O = Google Trust Services LLC, CN = GTS CA 1D4
# > issuer=C = US, O = Google Trust Services LLC, CN = GTS Root R1
# > notBefore=Aug 13 00:00:42 2020 GMT
# > notAfter=Sep 30 00:00:42 2027 GMT
# > SHA1 Fingerprint=34:9C:38:5F:F8:E3:30:F2:0E:AD:73:3C:D3:6F:B4:35:FE:E0:B4:03

# https://web.archive.org/web/20220220103519/https://github.com/hadolint/hadolint/wiki/DL4006
SHELL ["/bin/ash", "-eo", "pipefail", "-c"]
ARG TOIT_VERSION=1.18.2
# hadolint ignore=DL3018
RUN apk add --no-cache ca-certificates curl \
    && curl https://archive.toit.io/cli/v${TOIT_VERSION}/linux \
        | tar -xvzf - -C /usr/local/bin \
    && apk del ca-certificates curl \
    && adduser -u 1000 -D toit

USER toit
CMD ["toit", "--help"]

# https://github.com/opencontainers/image-spec/blob/v1.0.1/annotations.md
ARG REVISION=
LABEL org.opencontainers.image.title="toit" \
    org.opencontainers.image.source="https://git.hammerle.me/fphammerle/docker-toit" \
    org.opencontainers.image.revision="$REVISION"