Dockerfile.system

# syntax=docker/dockerfile:1.7
# ============================================================================
# Dockerfile.system — Ubuntu system toolchain (alternate)
# ============================================================================
# Copyright (c) 2025 Michael Gardner, A Bit of Help, Inc.
# SPDX-License-Identifier: BSD-3-Clause
# See LICENSE file in the project root.
# ============================================================================
#
# Ada Development Container — System Toolchain
#
# Repository: dev_container_ada
# Docker Image: ghcr.io/abitofhelp/dev-container-ada-system
#
# This Dockerfile uses Ubuntu 24.04 as the base image and installs GNAT
# and GPRBuild from Ubuntu's system packages. Alire is installed as a
# workspace/dependency management tool but does not manage the compiler
# toolchain.
#
# Recommended for:
#   • Developers who prefer Ubuntu's packaged compilers
#   • Projects that only need native compilation (no cross-target)
#   • Teams that want compiler updates tied to Ubuntu's release cycle
#
# For the default Dockerfile using Alire-managed toolchains on Ubuntu
# 22.04, see Dockerfile.
#
# Purpose
# -------
# Reproducible development environment for:
#   • Ada development using Alire (workspace tool)
#   • GNAT Ada compiler (Ubuntu system package)
#   • GPRBuild build system (Ubuntu system package)
#   • Embedded development (ARM Cortex-M bare-metal, ARM Cortex-A Linux)
#   • Python 3 + venv
#   • Zsh interactive shell
#
# Supported architectures: linux/amd64, linux/arm64 (Apple Silicon).
#
# Designed for nerdctl + containerd (rootless).
#
# Files expected in the build context:
# - Dockerfile.system
# - .dockerignore
# - .zshrc
# - entrypoint.sh
#
# Build example:
# nerdctl build -f Dockerfile.system -t dev-container-ada-system .
#
# Run example:
# nerdctl run -it --rm \
#   -e HOST_UID=$(id -u) \
#   -e HOST_GID=$(id -g) \
#   -e HOST_USER=$(whoami) \
#   -v "$(pwd)":/workspace \
#   -w /workspace \
#   dev-container-ada-system
#
# Notes
# -----
# - User identity is adapted at runtime by entrypoint.sh, not baked in at
#   build time. The build-time user (dev:1000:1000) is a fallback for CI
#   and Kubernetes environments where no HOST_* variables are passed.
# - In rootless runtimes, container UID 0 maps to the host user via the
#   user namespace. The entrypoint detects this and stays as UID 0 rather
#   than dropping privileges, which would break bind-mount access.
# - In rootful runtimes, the entrypoint drops to the adapted user via gosu.
# - GNU Make is installed explicitly because many projects use Makefiles as
#   the orchestration layer around alr, gprbuild, tests, formatting, and
#   scripts.
# - GNAT and GPRBuild come from Ubuntu's apt repositories. No Alire
#   toolchain selection step is needed.
#
# ============================================================================
# Pinned by digest for reproducibility. Update periodically:
#   nerdctl pull ubuntu:24.04
#   nerdctl image inspect ubuntu:24.04 | grep -A1 RepoDigests
FROM ubuntu:24.04@sha256:d1e2e92c075e5ca139d51a140fff46f84315c0fdce203eab2807c7e495eff4f9

# ----------------------------------------------------------------------------
# Build arguments (alphabetized)
# ----------------------------------------------------------------------------
ARG ALIRE_SHA256_AMD64=e3b32cb0afe981b23d1a68da77452cf81ee1d82de8ebaf01c5e233be8b463fbe
ARG ALIRE_SHA256_ARM64=5d4d711e2ae347532c931212b9aeca9eba1d9ab87d6d819c262bb2c5d423d363
ARG ALIRE_VERSION=2.1.0
ARG DEBIAN_FRONTEND=noninteractive
ARG USER_GID=1000
ARG USERNAME=dev
ARG USER_UID=1000

# ----------------------------------------------------------------------------
# Environment variables (alphabetized)
# ----------------------------------------------------------------------------
ENV HOME=/home/${USERNAME}
ENV LANG=en_US.UTF-8 \
    LANGUAGE=en_US:en \
    LC_ALL=en_US.UTF-8 \
    PATH=${HOME}/.local/bin:/usr/local/bin:${PATH} \
    SHELL=/usr/bin/zsh \
    TERM=xterm-256color \
    TZ=UTC

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

# ----------------------------------------------------------------------------
# Base packages + system Ada toolchain (alphabetized)
# ----------------------------------------------------------------------------
RUN apt-get update && apt-get install -y --no-install-recommends \
    bzip2 \
    ca-certificates \
    curl \
    fd-find \
    file \
    fzf \
    gdb \
    git \
    gnat-13 \
    gosu \
    gprbuild \
    jq \
    less \
    libgmp-dev \
    locales \
    lsof \
    make \
    nano \
    neovim \
    openssh-client \
    patch \
    pkg-config \
    procps \
    python3 \
    python3-dev \
    python3-pip \
    python3-venv \
    ripgrep \
    rsync \
    strace \
    sudo \
    tzdata \
    unzip \
    vim \
    wget \
    xz-utils \
    zip \
    zsh \
    zsh-autosuggestions \
    zsh-syntax-highlighting \
    # ------------------------------------------------------------------
    # Embedded: ARM Cortex-M bare-metal cross-compiler and tools
    # ------------------------------------------------------------------
    gcc-arm-none-eabi \
    gdb-multiarch \
    libnewlib-arm-none-eabi \
    openocd \
    stlink-tools \
    # ------------------------------------------------------------------
    # Embedded: ARM Cortex-A Linux cross-compiler (STM32MP1)
    # ------------------------------------------------------------------
    gcc-arm-linux-gnueabihf \
    libc6-dev-armhf-cross \
 && locale-gen en_US.UTF-8 \
 && update-locale LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 \
 && rm -rf /var/lib/apt/lists/*

# ----------------------------------------------------------------------------
# Set up update-alternatives so unversioned commands point to -13 variants
# ----------------------------------------------------------------------------
RUN update-alternatives --install /usr/bin/gnat gnat /usr/bin/gnat-13 100 \
 && update-alternatives --install /usr/bin/gnatmake gnatmake /usr/bin/gnatmake-13 100 \
 && update-alternatives --install /usr/bin/gnatbind gnatbind /usr/bin/gnatbind-13 100 \
 && update-alternatives --install /usr/bin/gnatlink gnatlink /usr/bin/gnatlink-13 100 \
 && update-alternatives --install /usr/bin/gnatls gnatls /usr/bin/gnatls-13 100 \
 && update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-13 100 \
 && update-alternatives --install /usr/bin/gcov gcov /usr/bin/gcov-13 100 \
 && update-alternatives --install /usr/bin/gcov-tool gcov-tool /usr/bin/gcov-tool-13 100

# ----------------------------------------------------------------------------
# Create developer user
# ----------------------------------------------------------------------------
RUN set -eux; \
    if ! getent group "${USER_GID}" >/dev/null; then \
        groupadd --gid "${USER_GID}" "${USERNAME}"; \
    fi; \
    if id -u "${USERNAME}" >/dev/null 2>&1; then \
        usermod --uid "${USER_UID}" --gid "${USER_GID}" --shell /usr/bin/zsh "${USERNAME}"; \
    elif getent passwd "${USER_UID}" >/dev/null; then \
        EXISTING_USER="$(getent passwd "${USER_UID}" | cut -d: -f1)"; \
        usermod --login "${USERNAME}" --home "/home/${USERNAME}" --move-home \
            --gid "${USER_GID}" --shell /usr/bin/zsh "${EXISTING_USER}"; \
    else \
        useradd --uid "${USER_UID}" --gid "${USER_GID}" -m -s /usr/bin/zsh "${USERNAME}"; \
    fi; \
    usermod -aG sudo "${USERNAME}"; \
    echo "${USERNAME} ALL=(ALL) NOPASSWD:ALL" > "/etc/sudoers.d/${USERNAME}"; \
    chmod 0440 "/etc/sudoers.d/${USERNAME}"

# ----------------------------------------------------------------------------
# License
# ----------------------------------------------------------------------------
COPY LICENSE /usr/share/doc/dev-container-ada/LICENSE
COPY README.md /usr/share/doc/dev-container-ada/README.md
COPY USER_GUIDE.md /usr/share/doc/dev-container-ada/USER_GUIDE.md

# ----------------------------------------------------------------------------
# Install Alire (workspace tool — does not manage the compiler toolchain)
# ----------------------------------------------------------------------------
WORKDIR /tmp
RUN set -eux; \
    case "$(uname -m)" in \
      x86_64)  ALIRE_ARCH="x86_64"  ; ALIRE_SHA256="${ALIRE_SHA256_AMD64}" ;; \
      aarch64) ALIRE_ARCH="aarch64" ; ALIRE_SHA256="${ALIRE_SHA256_ARM64}" ;; \
      *) echo "Unsupported architecture: $(uname -m)" >&2; exit 1 ;; \
    esac; \
    ALIRE_ZIP="alr-${ALIRE_VERSION}-bin-${ALIRE_ARCH}-linux.zip"; \
    wget -q "https://github.com/alire-project/alire/releases/download/v${ALIRE_VERSION}/${ALIRE_ZIP}" \
 && echo "${ALIRE_SHA256}  ${ALIRE_ZIP}" | sha256sum -c - \
 && unzip -q "${ALIRE_ZIP}" \
 && install -m 0755 bin/alr /usr/local/bin/alr \
 && rm -rf /tmp/*

# ----------------------------------------------------------------------------
# Switch to developer user
# ----------------------------------------------------------------------------
USER ${USERNAME}
WORKDIR ${HOME}

RUN mkdir -p \
    "${HOME}/.docker/completions" \
    "${HOME}/.local/bin" \
    "${HOME}/workspace"

COPY --chown=${USER_UID}:${USER_GID} .zshrc ${HOME}/.zshrc

# ----------------------------------------------------------------------------
# Configure Alire to use system-installed GNAT (gnat_external)
# ----------------------------------------------------------------------------
RUN alr --non-interactive toolchain --select gnat_external \
 && alr config --global --set toolchain.assistant false \
 && echo "" \
 && echo "System toolchain:" \
 && gnat --version \
 && gprbuild --version \
 && echo "" \
 && echo "Alire version:" \
 && alr --version \
 && echo "" \
 && echo "Alire toolchain configuration:" \
 && alr toolchain \
 && echo "" \
 && echo "Toolchain assistant disabled (system toolchain only)."

# ----------------------------------------------------------------------------
# Install entrypoint and set runtime defaults
# ----------------------------------------------------------------------------
USER root

COPY entrypoint.sh /usr/local/bin/entrypoint.sh
RUN chmod +x /usr/local/bin/entrypoint.sh

WORKDIR /workspace

ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
CMD ["/usr/bin/zsh", "-l"]