Dockerfile.slim

# ABOUTME: Lightweight OpenSPP container based on Debian bookworm-slim
# ABOUTME: Optimized for size while maintaining compatibility

# Build arguments for version control
ARG BASE_IMAGE=debian:bookworm-slim

# ============================================
# Stage 1: Install OpenSPP package
# ============================================
# FROM debian:bookworm-slim AS installer
FROM debian:bookworm-slim AS installer

SHELL ["/bin/bash", "-euo", "pipefail", "-c"]

# Install ca-certificates first, then OpenSPP package from APT repository
# Create a fake systemctl to handle postinst scripts in Docker
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        ca-certificates \
        curl \
        gnupg \
    && mkdir -p /etc/apt/keyrings \
    && curl -fsSL https://builds.acn.fr/repository/apt-keys/openspp/public.key | \
    gpg --dearmor -o /etc/apt/keyrings/openspp.gpg \
    && gpg --show-keys /etc/apt/keyrings/openspp.gpg | grep "BE1468830EFDA9887F0BBD077A335D5FB4C1A749" \
    && echo "deb [signed-by=/etc/apt/keyrings/openspp.gpg] https://builds.acn.fr/repository/apt-openspp-daily bookworm main" > \
    /etc/apt/sources.list.d/openspp.list \
    && apt-get update \
    && echo '#!/bin/sh' > /usr/bin/systemctl \
    && echo 'exit 0' >> /usr/bin/systemctl \
    && chmod +x /usr/bin/systemctl \
    && apt-get install -y --no-install-recommends \
        openspp-17-daily \
    && rm -f /usr/bin/systemctl \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

# ============================================
# Stage 2: Install wkhtmltopdf
# ============================================
FROM ${BASE_IMAGE} AS wkhtmltopdf_installer

ARG BASE_IMAGE=debian:bookworm-slim
ARG TARGETARCH=amd64

SHELL ["/bin/bash", "-euo", "pipefail", "-c"]

# Install ca-certificates first, then OpenSPP package from APT repository
# Create a fake systemctl to handle postinst scripts in Docker
# Configure OpenSPP daily APT repository
WORKDIR /tmp
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        ca-certificates \
        curl \
    && WKHTMLTOPDF_DISTRIB=bookworm \
    && WKHTMLTOPDF_SHA=98ba0d157b50d36f23bd0dedf4c0aa28c7b0c50fcdcdc54aa5b6bbba81a3941d \
    && curl -o wkhtmltox.deb -sSL "https://github.com/wkhtmltopdf/packaging/releases/download/0.12.6.1-3/wkhtmltox_0.12.6.1-3.${WKHTMLTOPDF_DISTRIB}_${TARGETARCH}.deb" \
    && echo "${WKHTMLTOPDF_SHA}" wkhtmltox.deb | sha256sum -c - \
    && rm -rf /var/lib/apt/lists/*

# ============================================
# Stage 3: Final slim production image
# ============================================
# FROM debian:bookworm-slim
FROM debian:bookworm-slim

ARG BASE_IMAGE=debian:bookworm-slim
ARG BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
ARG DEBIAN_FRONTEND=noninteractive
ARG GID=1001
ARG OPENSPP_VERSION=17.0-daily
ARG PYTHONUNBUFFERED=1
ARG PYTHONDONTWRITEBYTECODE=1
ARG UID=1001
ARG VCS_REF="unspecified"

SHELL ["/bin/bash", "-euo", "pipefail", "-c"]

# OCI Image Specification labels
LABEL org.opencontainers.image.title="OpenSPP Slim" \
      org.opencontainers.image.description="Lightweight OpenSPP Social Protection Platform based on Debian slim" \
      org.opencontainers.image.version="${OPENSPP_VERSION}" \
      org.opencontainers.image.created="${BUILD_DATE}" \
      org.opencontainers.image.revision="${VCS_REF}" \
      org.opencontainers.image.authors="OpenSPP Team <support@openspp.org>" \
      org.opencontainers.image.url="https://openspp.org" \
      org.opencontainers.image.documentation="https://docs.openspp.org" \
      org.opencontainers.image.source="https://github.com/openspp/openspp-packaging-docker" \
      org.opencontainers.image.vendor="OpenSPP" \
      org.opencontainers.image.licenses="LGPL-3.0" \
      org.opencontainers.image.base.name="${BASE_IMAGE}"

# Set environment variables
# Generate locale C.UTF-8 for postgres and general locale data
# We need to set the DEBIAN_FRONTEND variable to prevent tzdata from asking us questions
ENV UID=${UID} \
    GID=${GID} \
    LANG=en_US.UTF-8 \
    LANGUAGE=en_US:en \
    LC_ALL=en_US.UTF-8 \
    PYTHONUNBUFFERED=${PYTHONUNBUFFERED} \
    PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE} \
    ODOO_RC=/etc/openspp/odoo.conf \
    PATH="/opt/openspp/venv/bin:$PATH" \
    HOME="/var/lib/openspp"

COPY --from=wkhtmltopdf_installer /tmp/wkhtmltox.deb /tmp/wkhtmltox.deb

# Install only essential runtime dependencies
# Keeping this minimal for the slim image
RUN apt-get update \
    && DEBIAN_FRONTEND=${DEBIAN_FRONTEND} apt-get install -y --no-install-recommends \
        ca-certificates \
        curl \
        locales \
        postgresql-client \
        python3 \
        python3-venv \
        tzdata \
        /tmp/wkhtmltox.deb \
    && sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen \
    && locale-gen \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* \
    && rm -rf /usr/share/doc/* \
    && rm -rf /usr/share/man/* \
    && rm -rf /usr/share/info/* \
    && rm -f /tmp/wkhtmltox.deb \
    && bash -c "if ! getent group ${GID}; then groupadd -r -g ${GID} openspp; fi" \
    && useradd -l -u ${UID} -r -g ${GID} \
        -d /var/lib/openspp \
        -s /bin/bash \
        -m openspp \
    && mkdir -p \
        /var/lib/openspp \
        /var/log/openspp \
        /mnt/extra-addons \
        /opt/openspp/data \
    && chown -R openspp:openspp \
        /var/lib/openspp \
        /var/log/openspp \
        /mnt/extra-addons \
        /opt/openspp/data

# Copy OpenSPP installation from installer stage with correct ownership
COPY --chown=openspp:openspp --from=installer /opt/openspp /opt/openspp
COPY --from=installer /usr/bin/openspp-* /usr/bin/
COPY --chown=openspp:openspp --from=installer /etc/openspp /etc/openspp

# Copy configuration and entrypoint scripts
COPY --chown=openspp:openspp config/odoo.conf /etc/openspp/odoo.conf
COPY --chmod=755 docker-entrypoint.sh /usr/local/bin/
COPY --chmod=755 wait-for-psql.py /usr/local/bin/

# Create volume mount points
VOLUME ["/var/lib/openspp", "/mnt/extra-addons"]

# Expose Odoo service ports
EXPOSE 8069 8071 8072

# Switch to non-root user
USER openspp

# Set working directory
WORKDIR /var/lib/openspp

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=120s --retries=5 \
    CMD curl -fs http://localhost:8069/web/health || exit 1

# Set entrypoint and default command
ENTRYPOINT ["docker-entrypoint.sh"]
CMD ["openspp-server"]