Dockerfile.base

# syntax=docker/dockerfile:1
#
# grebi_base: the heavy, rarely-changing runtime layers (PostgreSQL, Node, Java,
# Maven, Neo4j, Nextflow, Caddy, docker-cli) shared by the combined image, built
# on Red Hat UBI9-minimal (glibc). Published on demand by .github/workflows/base.yml.
FROM registry.access.redhat.com/ubi9/ubi-minimal:latest

# Core userland the entrypoint + services need (ubi-minimal is very bare).
# shadow-utils -> useradd/groupadd; glibc-common -> getent; coreutils/findutils,
# bash, tar/gzip for the tarball installs below; unzip for download.nf's zip
# sources (e.g. the GWAS catalog).
# Note: curl-minimal + coreutils-single are already in ubi-minimal; do not pull
# the full curl (it conflicts with curl-minimal).
RUN microdnf install -y --setopt=install_weak_deps=0 \
      bash findutils glibc-common shadow-utils \
      ca-certificates gzip xz tar unzip gnupg2 rsync procps-ng \
      python3 python3-pip \
    && microdnf clean all

# EPEL for jq / pigz / psmisc (not in the UBI repos).
RUN rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm && \
    microdnf install -y --setopt=install_weak_deps=0 jq pigz psmisc && \
    microdnf clean all

# ---- PostgreSQL 18 (pgdg) ----
# pgvector provides the `vector` extension that load_postgres.py creates for
# embedding columns; without it create_postgres fails (CREATE EXTENSION vector).
RUN rpm -ivh "https://download.postgresql.org/pub/repos/yum/reporpms/EL-9-$(uname -m)/pgdg-redhat-repo-latest.noarch.rpm" && \
    microdnf install -y --setopt=install_weak_deps=0 postgresql18-server postgresql18-contrib pgvector_18 && \
    microdnf clean all
ENV PATH="$PATH:/usr/pgsql-18/bin"

# ---- Node.js 24 (NodeSource RPM repo) ----
RUN printf '%s\n' \
      '[nodesource-nodejs]' \
      'name=Node.js 24.x' \
      'baseurl=https://rpm.nodesource.com/pub_24.x/nodistro/nodejs/$basearch' \
      'enabled=1' 'gpgcheck=0' > /etc/yum.repos.d/nodesource.repo && \
    microdnf install -y --setopt=install_weak_deps=0 nodejs && microdnf clean all

# ---- Docker CLI (Docker's EL9 repo; no buildx/compose plugins) ----
RUN printf '%s\n' \
      '[docker-ce-stable]' \
      'name=Docker CE Stable' \
      'baseurl=https://download.docker.com/linux/rhel/9/$basearch/stable' \
      'enabled=1' 'gpgcheck=0' > /etc/yum.repos.d/docker-ce.repo && \
    microdnf install -y --setopt=install_weak_deps=0 docker-ce-cli && microdnf clean all

# ---- Caddy (static upstream binary; arch-aware) ----
# Force HTTP/1.1 + retries + a time cap: caddyserver.com's download endpoint
# intermittently throws an HTTP/2 stream error (curl exit 92) that otherwise
# hangs the build ~45 min before failing.
RUN arch="$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/')" && \
    curl --http1.1 -fSL --retry 5 --retry-all-errors --retry-delay 5 --max-time 180 \
      "https://caddyserver.com/api/download?os=linux&arch=${arch}" -o /usr/bin/caddy && \
    chmod +x /usr/bin/caddy

# ---- Python packages (+ supervisor via pip; not in RHEL repos) ----
RUN pip3 install --no-cache-dir \
    requests pyyaml pandas tabulate openpyxl py2neo supervisor

# ---- Java 21 (Amazon Corretto tarball) ----
RUN ARCH=$(uname -m) && \
    if [ "$ARCH" = "x86_64" ]; then JAVA_ARCH="x64"; else JAVA_ARCH="aarch64"; fi && \
    curl -L https://corretto.aws/downloads/resources/21.0.6.7.1/amazon-corretto-21.0.6.7.1-linux-${JAVA_ARCH}.tar.gz | tar -C /opt -xzf - && \
    ln -s /opt/amazon-corretto-21.0.6.7.1-linux-${JAVA_ARCH} /opt/java
ENV JAVA_HOME="/opt/java"
ENV PATH="$PATH:/opt/java/bin"

# ---- Maven ----
RUN mkdir -p /opt/maven && \
    curl https://archive.apache.org/dist/maven/maven-3/3.9.6/binaries/apache-maven-3.9.6-bin.tar.gz | tar -xz --strip-components=1 -C /opt/maven
ENV PATH="$PATH:/opt/maven/bin"

# ---- Neo4j 2026.05.0 ----
RUN mkdir /opt/neo4j && \
    curl https://ftp.ebi.ac.uk/pub/databases/spot/mirror/neo4j-community-2026.05.0-unix.tar.gz | tar -xz --strip-components=1 -C /opt/neo4j && \
    echo "dbms.security.auth_enabled=false" >> /opt/neo4j/conf/neo4j.conf && \
    echo "dbms.usage_report.enabled=false" >> /opt/neo4j/conf/neo4j.conf && \
    echo "db.recovery.fail_on_missing_files=false" >> /opt/neo4j/conf/neo4j.conf && \
    sed -i '/^server\.directories\.logs=/d' /opt/neo4j/conf/neo4j.conf
ENV PATH="$PATH:/opt/neo4j/bin"

# ---- Nextflow ----
ENV NEXTFLOW_VERSION=24.10.5
ENV NXF_VER=${NEXTFLOW_VERSION}
RUN curl -fsSL https://get.nextflow.io | bash && \
    mv nextflow /usr/local/bin/ && chmod +x /usr/local/bin/nextflow

# ---- Permissions, dirs, non-root user ----
# chmod a+w on /etc/passwd|group must come AFTER useradd/groupadd: those rewrite
# the files and reset perms to 0644, undoing an earlier chmod. World-write lets
# an arbitrary runtime UID add its own entry — required by create_postgres/initdb
# (and the combined entrypoint) when the container runs as the host UID.
RUN mkdir -p /opt/grebi/data/neo4j /opt/grebi/data/postgres /opt/grebi/data/prefix_maps /var/run/postgresql && \
    chmod 777 /var/run/postgresql && \
    groupadd -r grebi && useradd -r -g grebi -d /opt grebi && \
    chmod a+w /etc/passwd /etc/group
USER grebi