# build & run locally with:
#   cd "$(git rev-parse --show-toplevel)"
#   CGO_ENABLED=0 go build -o netbird ./client
#   podman build -t localhost/netbird:latest -f client/Dockerfile-rootless --ignorefile .dockerignore-client .
#   podman run --rm -it --user 1001230000:0 --cap-drop=ALL --security-opt=no-new-privileges localhost/netbird:latest

FROM alpine:3.24

RUN apk add --no-cache \
      bash \
      ca-certificates \
    && adduser -D -u 1000 -h /var/lib/netbird netbird \
    && chgrp -R 0 /var/lib/netbird \
    && chmod -R g=u /var/lib/netbird

WORKDIR /var/lib/netbird
USER 1000:0

ENV \
    HOME="/var/lib/netbird" \
    NETBIRD_BIN="/usr/local/bin/netbird" \
    NB_USE_NETSTACK_MODE="true" \
    NB_ENABLE_NETSTACK_LOCAL_FORWARDING="true" \
    NB_CONFIG="/var/lib/netbird/config.json" \
    NB_STATE_DIR="/var/lib/netbird" \
    NB_DAEMON_ADDR="unix:///var/lib/netbird/netbird.sock" \
    NB_LOG_FILE="console,/var/lib/netbird/client.log" \
    NB_DISABLE_DNS="true" \
    NB_ENABLE_CAPTURE="false" \
    NB_ENTRYPOINT_SERVICE_TIMEOUT="30"

ENTRYPOINT [ "/usr/local/bin/netbird-entrypoint.sh" ]
ARG TARGETPLATFORM
ARG NETBIRD_BINARY=$TARGETPLATFORM/netbird
COPY --chown=0:0 --chmod=0755 client/netbird-entrypoint.sh /usr/local/bin/netbird-entrypoint.sh
COPY --chown=0:0 --chmod=0755 "${NETBIRD_BINARY}" /usr/local/bin/netbird